CVE-2026-113340 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome deployments, particularly in environments where exposure to untrusted HTML content is possible, should assess and mitigate this vulnerability.

Why it matters

CVE-2026-113340 is a memory corruption vulnerability in ANGLE in Google Chrome that could allow a remote attacker to potentially read memory inside the sandbox. Defenders should prioritize verifying Chrome versions and updating to 156.0.8078.47 or later.

• Verify Chrome versions to identify potentially vulnerable deployments
• Update Chrome to version 156.0.8078.47 or later to address the vulnerability
• Monitor for crafted HTML pages that could exploit the vulnerability
• Implement additional security measures to protect against potential memory corruption attacks

Technical summary

The vulnerability is caused by a memory corruption issue in ANGLE in Google Chrome on Windows prior to version 156.0.8078.47. A remote attacker could potentially read memory inside the sandbox via a crafted HTML page. This issue affects Google Chrome deployments on Windows. The vulnerability allows an attacker to potentially read memory inside the sandbox, which could lead to information disclosure. Defenders should prioritize verifying Chrome versions and updating to 156.0.8078.47 or later to address potential memory corruption vulnerabilities. The issue is related to the ANGLE component in Google Chrome, and the fix involves updating to a version that addresses the memory corruption issue.

Defensive priority

Defenders should prioritize verifying Chrome versions and updating to 156.0.8078.47 or later to address potential memory corruption vulnerabilities.

Recommended defensive actions

• Verify Chrome versions and update to 156.0.8078.47 or later
• Monitor for crafted HTML pages that could exploit the vulnerability
• Implement sandboxing and memory protection measures
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the memory corruption vulnerability in ANGLE in Google Chrome. The vulnerability allows a remote attacker to potentially read memory inside the sandbox via a crafted HTML page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.