CVE-2026-113336 Google CVE debrief

Who should care

Google Chrome users, particularly those with exposure to untrusted input, should assess their version and update to 156.0.8078.47 or later. This includes users with Chrome installed on their systems, especially in environments where security is a priority. IT administrators should prioritize updating Chrome to the latest version to prevent potential exploitation. Users should also review system logs for signs of exploitation attempts.

Why it matters

CVE-2026-113336 is a high-severity memory corruption vulnerability in Google Chrome's Compositing feature. Users should update to version 156.0.8078.47 or later to mitigate potential exploitation.

• Potential for arbitrary code execution outside the sandbox
• Remote attacker could exploit via crafted HTML page
• High severity according to Chromium

Technical summary

Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. This vulnerability has a high severity according to Chromium and affects Google Chrome users. Updating to version 156.0.8078.47 or later mitigates the vulnerability. Technical details are based on official CVE Program and NVD records; further analysis is recommended for comprehensive risk assessment. The CVE record was published on 2026-10-20T21:01:56.282Z.

Defensive priority

High

Recommended defensive actions

• Update Google Chrome to version 156.0.8078.47 or later
• Review system logs for potential exploitation attempts
• Verify Chrome version in use and assess exposure
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Official CVE Program and NVD records indicate memory corruption in Google Chrome's Compositing feature prior to version 156.0.8078.47. The Chromium security severity is rated High. Evidence is limited to CVE Program and NVD records; further verification is recommended. Defensive priorities should focus on updating Google Chrome to version 156.0.8078.47 or later and reviewing system logs for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.