CVE-2026-113295 Google CVE debrief

Who should care

Defenders responsible for Google Chrome deployments on Windows should assess exposure and prioritize patching to prevent potential memory reads within the sandbox. This includes reviewing compensating controls, monitoring for exploitation attempts, and updating incident response plans. Security teams should also review vendor guidance for additional mitigation strategies.

Why it matters

CVE-2026-113295 is a high-severity vulnerability in Google Chrome on Windows, allowing a remote attacker to read memory inside the sandbox via a crafted HTML page. Defenders should prioritize verifying and applying the patch to prevent potential memory reads within the sandbox.

• Verify patch application to prevent potential memory reads
• Monitor for exploitation attempts to detect potential attacks
• Update incident response plans to address potential sandbox escapes

Technical summary

The vulnerability is an out-of-bounds read in ANGLE, a component used in Google Chrome. This could allow a remote attacker to read memory inside the sandbox via a crafted HTML page. The affected version is Google Chrome prior to 156.0.8078.47. This vulnerability has a high severity rating from Chromium. Defenders should prioritize verifying and applying the patch to prevent potential memory reads within the sandbox. The vulnerability was published on 2026-10-20T21:01:55.337Z and last modified on 2026-10-21T15:38:00.224Z.

Defensive priority

Defenders should prioritize verifying and applying the patch to prevent potential memory reads within the sandbox.

Recommended defensive actions

• Verify and apply the patch to Google Chrome
• Monitor for potential exploitation attempts
• Review and update incident response plans
• Perform asset inventory of Google Chrome deployments on Windows
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Review vendor guidance for additional mitigation strategies

Evidence notes

The vulnerability is described as an out-of-bounds read in ANGLE, with a high severity rating from Chromium. The affected version is Google Chrome prior to 156.0.8078.47. This information is based on the official CVE Program record and NIST NVD detail page. Defenders should verify patch application and monitor for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.