PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113275 Google CVE debrief

CVE-2026-113275 debrief based on CVE Program and NVD records. Google Chrome users should assess exposure to version 156.0.8078.47 and earlier. The CVE record was published on 2026-10-20T21:02:06.948Z and has not been modified since then. This use-after-free vulnerability in Google Chrome's API could allow remote attackers to execute arbitrary code inside the sandbox via a crafted HTML page. Users should review and apply updates to ensure version 156.0.8078.47 or later is deployed. Monitoring for suspicious activity and verifying Chrome configuration are also recommended.

Vendor
Google
Product
Chrome
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-21
Advisory published
2026-10-20
Advisory updated
2026-10-21

Who should care

Google Chrome users, particularly those in environments where Chrome is used for browsing or other purposes, should assess their exposure to this vulnerability and take steps to update or mitigate as necessary.

Why it matters

CVE-2026-113275 is a use-after-free vulnerability in Google Chrome's API that could allow remote attackers to execute arbitrary code inside the sandbox. Defenders should prioritize updating Chrome to version 156.0.8078.47 or later and monitor for suspicious activity.

  • Remote attackers may be able to execute arbitrary code inside the sandbox via crafted HTML pages.
  • Successful exploitation could lead to unauthorized actions within the sandbox.
  • Defenders should prioritize updating Google Chrome to version 156.0.8078.47 or later.
  • Verification of Chrome version and monitoring for suspicious activity are recommended.

Technical summary

A use-after-free vulnerability exists in the API of Google Chrome prior to version 156.0.8078.47. This vulnerability could allow a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability is considered Medium severity by Chromium. Defenders should prioritize updating Chrome to version 156.0.8078.47 or later and monitor for suspicious activity. Verification of Chrome version and configuration are recommended to ensure proper security posture against this vulnerability. Successful exploitation could lead to unauthorized actions within the sandbox.

Defensive priority

Medium

Recommended defensive actions

  • Review and apply Google Chrome updates to ensure version 156.0.8078.47 or later is deployed.
  • Monitor Google Chrome for any additional advisories or patches related to this vulnerability.
  • Verify that Google Chrome is properly configured and secured in your environment.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record and NVD entry indicate a use-after-free vulnerability in Google Chrome's API prior to version 156.0.8078.47. This vulnerability could allow a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113275 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113275

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113275 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113275

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2026-113275

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113275.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://issues.chromium.org/issues/502040109

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.