CVE-2026-113338 Google CVE debrief

Who should care

Google Chrome users, particularly those with versions prior to 156.0.8078.47, should assess exposure and update to the latest version. This includes administrators and users of Google Chrome in organizational settings, as well as individual users who may be affected by this vulnerability. IT teams should prioritize updating Chrome to version 156.0.8078.47 or later and review system logs for potential exploitation attempts.

Why it matters

CVE-2026-113338 is a high-severity use-after-free vulnerability in Google Chrome that allows remote attackers to execute arbitrary code inside the sandbox. Defenders should prioritize updating Chrome to version 156.0.8078.47 or later and monitor system logs for potential exploitation attempts.

• Remote attackers may execute arbitrary code inside the sandbox
• Successful exploitation requires user interaction via a crafted HTML page
• Defenders should prioritize updating Chrome to version 156.0.8078.47 or later
• Verify Chrome version and monitor system logs for potential exploitation attempts

Technical summary

A use-after-free vulnerability in Turbolev in Google Chrome prior to 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This issue was reported by an external researcher and patched by Google. The vulnerability affects Google Chrome versions prior to 156.0.8078.47. There are no reports of this vulnerability being exploited in the wild. The Chromium security severity is High. Users of Google Chrome prior to version 156.0.8078.47 are advised to update to the latest version to mitigate this vulnerability.

Defensive priority

High

Recommended defensive actions

• Update Google Chrome to version 156.0.8078.47 or later
• Review system logs for potential exploitation attempts
• Assess exposure of Chrome installations in your organization
• Verify Chrome version and monitor system logs for potential exploitation attempts
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry indicate a use-after-free vulnerability in Turbolev in Google Chrome prior to 156.0.8078.47. The Chromium security severity is High. This issue was reported by an external researcher and patched by Google. The vulnerability affects Google Chrome versions prior to 156.0.8078.47. There are no reports of this vulnerability being exploited in the wild.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.