PatchSiren cyber security CVE debrief

CVE-2026-113332 Google CVE debrief

A memory corruption vulnerability in Google Chrome's GPU, prior to version 156.0.8078.47, allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. This issue, tracked as CVE-2026-113332, was publicly disclosed on October 20, 2026. The vulnerability has a Medium security severity rating according to Chromium. Defenders should assess exposure and prioritize updates to mitigate potential attacks. The CVE record and source item provide details on the memory corruption vulnerability in Google Chrome's GPU.

Vendor: Google
Product: Chrome
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-20
Original CVE updated: 2026-10-20
Advisory published: 2026-10-20
Advisory updated: 2026-10-20

Who should care

Defenders responsible for managing Google Chrome deployments should assess exposure and prioritize updates. Roles include IT administrators, security teams, and incident response personnel.

Why it matters

CVE-2026-113332 is a memory corruption vulnerability in Google Chrome's GPU that allows remote attackers to execute arbitrary code within the sandbox. Defenders should prioritize updates to mitigate potential attacks.

Remote code execution within the sandbox
Potential for crafted HTML page attacks
Medium security severity rating

Technical summary

The CVE-2026-113332 vulnerability is a memory corruption issue in Google Chrome's GPU. It allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. The issue was publicly disclosed on October 20, 2026, and has a Medium security severity rating according to Chromium. The vulnerability affects Google Chrome prior to version 156.0.8078.47. Defenders should prioritize updates to mitigate potential attacks. The CVE record and source item provide details on the memory corruption vulnerability in Google Chrome's GPU.

Defensive priority

High

Recommended defensive actions

Update Google Chrome to version 156.0.8078.47 or later
Monitor for suspicious HTML pages
Implement sandboxing and isolation measures
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the memory corruption vulnerability in Google Chrome's GPU. The issue allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. The Chromium security severity is rated as Medium.

Sources and references

Verified primary and authoritative sources

CVE-2026-113332 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-113332

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-113332 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113332

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-113332
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113332.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

Supplemental source
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/517031871

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.