CVE-2026-113323 Google CVE debrief

Who should care

Defenders responsible for managing and securing Google Chrome on iOS devices should assess exposure and prioritize patching. This includes IT teams managing Chrome deployments, security teams monitoring for potential exploitation attempts, and incident response teams reviewing and updating plans to address potential use-after-free vulnerabilities.

Why it matters

CVE-2026-113323 is a use-after-free vulnerability in Google Chrome for iOS that could allow remote code execution inside the sandbox. Defenders managing Chrome on iOS should verify and apply the patch, monitor for suspicious activity, and review incident response plans.

• Potential execution of arbitrary code inside the sandbox.
• Possible exploitation via crafted HTML pages.
• Verification of patch application is necessary.
• Limited information available about actual exploitation.

Technical summary

A use-after-free vulnerability exists in Google Chrome for iOS versions prior to 156.0.8078.47. This issue allows a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability has been classified as Low severity by Chromium. Defenders should prioritize verifying and applying the patch for Google Chrome on iOS, specifically updating to version 156.0.8078.47 or later. The CVE record and NVD entry provide limited information about the vulnerability, with the primary details coming from the CVE Program.

Defensive priority

Defenders should prioritize verifying and applying the patch for Google Chrome on iOS, specifically updating to version 156.0.8078.47 or later.

Recommended defensive actions

• Verify and apply the patch for Google Chrome on iOS, updating to version 156.0.8078.47 or later.
• Monitor Google Chrome for iOS for any suspicious activity or potential exploitation attempts.
• Review and update incident response plans to address potential use-after-free vulnerabilities.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary details coming from the CVE Program and Chromium security severity classification as Low. Evidence is limited to CVE Program records and NVD assessments. Defenders should verify patch application and monitor for suspicious activity. The CVE was published on 2026-10-20T21:02:37.357Z and has not been modified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.