CVE-2026-113339 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome deployments should assess exposure and prioritize updating to the latest version. Defenders should verify Chrome version and update to 156.0.8078.47 or later. The vulnerability allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. Defenders should review and verify the version of Google Chrome in use and update to the latest version as necessary.

Why it matters

CVE-2026-113339 is a high-severity use-after-free vulnerability in Google Chrome's SVG component. Defenders should prioritize updating Chrome to version 156.0.8078.47 or later to prevent potential remote code execution within the sandbox. Exposure and exploitation require verification from official sources.

• Remote attackers may attempt to execute arbitrary code within the sandbox
• Successful exploitation could lead to unauthorized actions within the sandbox
• Defenders should verify Chrome version and update to 156.0.8078.47 or later
• Exposure requires verification from official sources

Technical summary

A use-after-free vulnerability exists in the SVG component of Google Chrome prior to version 156.0.8078.47. This issue allows a remote attacker to execute arbitrary code within the sandbox via a crafted HTML page. The vulnerability was addressed in Chrome version 156.0.8078.47. Defenders should review and verify the version of Google Chrome in use and update to the latest version as necessary. The CVE Program and NVD records indicate a high-severity use-after-free vulnerability in Google Chrome's SVG component. Exposure and exploitation require verification from official sources.

Defensive priority

High

Recommended defensive actions

• Update Google Chrome to version 156.0.8078.47 or later
• Review and verify the version of Google Chrome in use
• Monitor for any suspicious activity related to this vulnerability
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD records indicate a use-after-free vulnerability in Google Chrome's SVG component. The issue was addressed in Chrome version 156.0.8078.47. The vulnerability allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. Defenders should verify Chrome version and update to 156.0.8078.47 or later. The CVE record was published on 2026-10-20T21:01:47.919Z and has not been modified since then. Exposure and exploitation require verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.