CVE-2026-113250 Google CVE debrief

Who should care

Google Chrome users, particularly those with versions prior to 156.0.8078.47, should assess exposure and apply updates as necessary. IT administrators and security teams responsible for managing Google Chrome deployments should prioritize patching to prevent potential code execution inside the sandbox. Vulnerability management and security teams should review the CVE record and NVD entry for further details and verify that Google Chrome is properly secured

Why it matters

CVE-2026-113250 is a medium-severity use-after-free vulnerability in ANGLE in Google Chrome prior to 156.0.8078.47. Defenders should prioritize patching to prevent potential code execution inside the sandbox. Google Chrome users, especially those with versions prior to 156.0.8078.47, should assess exposure and apply updates as necessary. The vulnerability could be exploited remotely via a crafted HTML page. While the severity is medium, defenders should still treat this vulnerability with priority due to potential impact.

• Potential code execution inside the sandbox
• Remote attack via crafted HTML page
• Medium severity vulnerability according to Chromium security assessment

Technical summary

A use-after-free vulnerability exists in ANGLE in Google Chrome prior to 156.0.8078.47. This could allow a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability has a medium severity according to Chromium security assessment. Defenders should prioritize patching to prevent potential code execution inside the sandbox. The CVE record and NVD entry provide details on this vulnerability, but further verification is recommended due to limited evidence. Google Chrome users, especially those with versions prior to 156.0.8078.47, should assess exposure and apply updates as necessary.

Defensive priority

Medium

Recommended defensive actions

• Review and apply Google Chrome updates to ensure version 156.0.8078.47 or later is deployed.
• Assess exposure of Google Chrome installations to this vulnerability.
• Verify that Google Chrome is properly configured and monitored for suspicious activity.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on a use-after-free vulnerability in ANGLE in Google Chrome prior to 156.0.8078.47. The vulnerability could be exploited remotely via a crafted HTML page. While the severity is medium, defenders should still treat this vulnerability with priority due to potential impact. Evidence is limited to CVE Program and NVD records; further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.