CVE-2026-113302 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome deployments, particularly in environments where Extensions are used, should assess exposure and prioritize updating to the patched version.

Why it matters

CVE-2026-113302 is a use-after-free vulnerability in Google Chrome's Extensions feature that could allow remote code execution inside the sandbox. Defenders managing Chrome deployments, especially those using Extensions, should assess exposure and update to version 156.0.8078.47 or later. Evidence is based on official CVE Program and NVD records.

• Potential code execution inside the sandbox
• Remote attack vector via crafted HTML pages
• Requires updating to patched version for protection

Technical summary

A use-after-free vulnerability exists in the Extensions feature of Google Chrome prior to version 156.0.8078.47. This vulnerability allows remote attackers to potentially execute arbitrary code inside the sandbox via crafted HTML pages. The vulnerability has a medium severity level according to Chromium security severity ratings. It is recommended to update to the patched version for protection. The CVE Program and NVD records provide further details on this vulnerability. Defenders should assess exposure and prioritize updating to the patched version.

Defensive priority

High

Recommended defensive actions

• Update Google Chrome to version 156.0.8078.47 or later
• Review and monitor HTML page inputs for potential exploitation attempts
• Implement sandboxing and isolation for critical systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD records confirm a use-after-free vulnerability in Google Chrome's Extensions feature. The vulnerability is patched in version 156.0.8078.47. Evidence is based on official CVE Program and NVD records. Defenders should verify Chrome versions and Extension usage in their environments. The CVE record was published on 2026-10-20T21:02:04.657Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.