CVE-2026-113249 Google CVE debrief

Who should care

Defenders responsible for Google Chrome on iOS deployments, security teams, and vulnerability management teams should assess exposure and apply patches to prevent potential exploitation. They should also verify the exposure of Google Chrome on iOS versions prior to 156.0.8078.47 and review additional security controls. The affected platform is Google Chrome on iOS, and the vulnerability could allow remote code execution.

Why it matters

CVE-2026-113249 is an improper input validation vulnerability in Google Chrome on iOS that could allow remote code execution. Defenders should verify exposure, prioritize patching, and consider additional security controls.

• Potential remote code execution inside the sandbox
• Verification of Google Chrome on iOS versions prior to 156.0.8078.47
• Patching priority for Google Chrome on iOS

Technical summary

The vulnerability is caused by improper input validation in Google Chrome on iOS prior to version 156.0.8078.47. This could allow a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The issue affects Google Chrome on iOS, and defenders should prioritize verifying exposure and applying patches to prevent potential code execution. The CVE record was published on 2026-10-20T21:02:11.998Z and was last modified on 2026-10-21T03:58:43.300Z. The NVD entry is currently unclassified.

Defensive priority

Defenders should prioritize verifying exposure of Google Chrome on iOS versions prior to 156.0.8078.47 and applying the patch to prevent potential code execution.

Recommended defensive actions

• Verify Google Chrome on iOS versions prior to 156.0.8078.47 are patched
• Monitor Google Chrome on iOS for updates and apply patches promptly
• Consider implementing additional security controls to detect and prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, the CVSS score and severity are not provided. Defenders should verify the exposure of Google Chrome on iOS versions prior to 156.0.8078.47 and review additional security controls. The CVE was published on 2026-10-20T21:02:11.998Z and last modified on 2026-10-21T03:58:43.300Z.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.