CVE-2026-113254 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome deployments, particularly in environments where users access the internet or open untrusted HTML pages, should assess exposure and apply patches.

Why it matters

CVE-2026-113254 is a memory corruption vulnerability in Google Chrome's DevTools that could allow remote code execution inside the sandbox. Defenders should prioritize verifying exposure and applying patches, especially in environments where users access the internet or open untrusted HTML pages.

• Verify Chrome version and apply patches to prevent potential exploitation
• Restrict user access to untrusted HTML pages to reduce attack surface
• Monitor for suspicious activity in Chrome DevTools to detect potential attacks

Technical summary

The vulnerability exists in Google Chrome's DevTools, allowing potential remote code execution inside the sandbox via a crafted HTML page. Google has released a patch for this issue in Chrome version 156.0.8078.47. The vulnerability was assessed by the Chromium security team as having a Low severity. The patch addresses the memory corruption issue, preventing potential attackers from executing arbitrary code inside the sandbox. This vulnerability is isolated to the DevTools component and does not affect other parts of the Chrome browser.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Google Chrome versions prior to 156.0.8078.47, especially in environments where users access the internet or open untrusted HTML pages.

Recommended defensive actions

• Verify and apply Google Chrome updates to version 156.0.8078.47 or later
• Review and restrict user access to untrusted HTML pages
• Monitor for suspicious activity in Chrome DevTools
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE Program and NVD records provide details on the vulnerability, while Google's Chrome release blog post and Chromium issue tracker offer additional context on the patch and fix. The vulnerability was assessed by the Chromium security team as having a Low severity. The CVE record was published on 2026-10-20T21:02:49.956Z and has not been modified since then. There are no known instances of this vulnerability being exploited in the wild. The patch for this issue is included in Chrome version 156.0.8078.47 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.