CVE-2026-113290 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome deployments should assess exposure and prioritize patching to mitigate potential risks. This includes verifying Chrome versions, applying patches, and monitoring for potential exploitation attempts. Additionally, defenders should review sandboxing configurations and consider compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-113290 is a use-after-free vulnerability in Google Chrome's Input component that could allow code execution inside the sandbox. Defenders should verify Chrome versions, apply patches, and monitor for potential exploitation attempts.

• Potential code execution inside the sandbox requires verification and mitigation
• Defenders must verify Chrome versions and apply patches to prevent exploitation
• Monitoring for sandbox escapes or code execution attempts is necessary

Technical summary

A use-after-free vulnerability exists in the Input component of Google Chrome prior to version 156.0.8078.47. This could allow a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability requires defenders to verify Chrome versions and apply patches to mitigate potential risks. Defenders should also review sandboxing configurations and monitor for potential exploitation attempts. The CVE Program and NVD records provide details on the vulnerability, but do not specify versions beyond 156.0.8078.47 as affected.

Defensive priority

Defenders should prioritize verifying Chrome versions and applying patches due to potential code execution risk inside the sandbox.

Recommended defensive actions

• Verify Chrome version and update to 156.0.8078.47 or later
• Monitor for potential sandbox escapes or code execution attempts
• Review and adjust sandboxing configurations for Chrome
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE Program and NVD records provide details on the vulnerability, but do not specify versions beyond 156.0.8078.47 as affected or provide additional impact information. Defenders should verify Chrome versions, apply patches, and monitor for potential exploitation attempts. The CVE record and NVD entry are the primary sources for this information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.