CVE-2026-113334 Google CVE debrief

Who should care

Defenders and IT administrators responsible for managing Google Chrome deployments on Windows should assess exposure and prioritize patching. This includes reviewing current version deployments, updating to the patched version (156.0.8078.47 or later), and monitoring for potential attacks.

Why it matters

CVE-2026-113334 is a high-severity vulnerability in Google Chrome on Windows, allowing potential arbitrary code execution inside the sandbox via crafted HTML pages. Defenders should assess exposure, prioritize patching, and monitor for potential attacks.

• Potential code execution inside the sandbox via crafted HTML pages.
• Requires verification of Chrome version and exposure to untrusted HTML sources.
• Patching priority to mitigate potential sandbox bypass risks.
• Monitoring for crafted HTML page attacks targeting this vulnerability.

Technical summary

The CVE-2026-113334 vulnerability involves improper input validation in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome on Windows. This flaw allows a remote attacker to potentially execute arbitrary code inside the sandbox by providing a crafted HTML page. The issue was patched in Chrome version 156.0.8078.47. The vulnerability has a high severity rating and defenders should assess exposure, prioritize patching, and monitor for potential attacks. The Chromium security severity is rated as High and the CVE record was published on 2026-10-20T21:01:53.163Z.

Defensive priority

High

Recommended defensive actions

• Assess exposure and prioritize patching for Google Chrome on Windows, especially for versions prior to 156.0.8078.47.
• Verify and apply the patch (156.0.8078.47 or later) to mitigate potential code execution risks.
• Monitor for and respond to potential crafted HTML page attacks targeting this vulnerability.
• Review and update incident response plans to address potential sandbox bypass scenarios.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability, CVE-2026-113334, was reported in Google Chrome on Windows prior to version 156.0.8078.47. The Chromium security severity is rated as High. This information is based on the official CVE Program record and the NIST NVD detail page. The CVE record was published on 2026-10-20T21:01:53.163Z and has not been modified since then. The source item providing CVE-2026-113334 details also confirms this information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.