CVE-2026-113309 Google CVE debrief

Who should care

Defenders responsible for Google Chrome deployments should assess exposure and prioritize patching to prevent potential memory reads within the sandbox. This includes IT administrators, security teams, and vulnerability management teams who oversee Google Chrome deployments in their organizations. Additionally, security teams should review and update incident response plans to address potential exploitation attempts. Operators of Google Chrome-based kiosks

Why it matters

CVE-2026-113309 is a high-severity vulnerability in Google Chrome that allows a remote attacker to read memory inside the sandbox. Defenders should prioritize verifying and applying the patch to prevent potential memory reads.

• Potential memory reads within the sandbox
• Need to verify and apply patches
• Monitoring for exploitation attempts

Technical summary

A high-severity out-of-bounds read vulnerability exists in Google Chrome prior to version 156.0.8078.47. This vulnerability allows a remote attacker to read memory inside the sandbox via a crafted HTML page. The vulnerability is caused by an out-of-bounds read in the Media component of Google Chrome. Defenders should prioritize verifying and applying the patch to prevent potential memory reads within the sandbox. The Chromium security team has assessed this vulnerability as High severity. This vulnerability requires user interaction to exploit.

Defensive priority

Defenders should prioritize verifying and applying the patch to prevent potential memory reads within the sandbox.

Recommended defensive actions

• Verify and apply the patch to Google Chrome
• Monitor for potential exploitation attempts
• Review and update incident response plans
• Conduct a thorough review of affected systems and assets
• Ensure all Google Chrome deployments are up-to-date with the latest security patches
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and references to vendor updates. The vulnerability has been patched in Google Chrome version 156.0.8078.47 or later. Defenders should verify and apply the patch to prevent potential memory reads within the sandbox. Additional information can be found in the Chromium issue tracker and the official CVE Program record.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.