CVE-2026-113341: 
Google Chrome vulnerability analysis and mitigation

CVE-2026-113341 is a memory corruption vulnerability in the Skia graphics library within Google Chrome on Android, allowing a remote attacker to potentially read memory inside the Chrome sandbox via a crafted HTML page. It was reported by Google on 2026-10-03 and publicly disclosed on 2026-10-20 as part of the Chrome 156 stable channel release. The vulnerability affects Google Chrome on Android versions prior to 156.0.8078.47. Google has rated this vulnerability as Critical in Chromium security severity; a formal CVSS score has not yet been published (EPSS: 0.0) (Chrome Releases, Feedly).

The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), indicating that Skia — Chrome's 2D graphics rendering engine — improperly handles memory buffer operations when processing certain HTML content on Android (Feedly). The attack vector is network-based and requires no authentication or user privileges beyond convincing a victim to visit a malicious web page; the attacker delivers a crafted HTML page that triggers the memory corruption in the Skia rendering pipeline. The impact is limited to reading memory within the Chrome sandbox process rather than full sandbox escape, though sensitive in-process data may be exposed. The Chromium issue tracker entry is bug 569165786, though details remain restricted pending broad user update (Chrome Releases).

Successful exploitation allows a remote, unauthenticated attacker to read memory contents within the Chrome sandbox process on Android devices, potentially exposing sensitive data such as credentials, session tokens, or other in-memory information processed by the browser. While the vulnerability does not appear to enable full sandbox escape or arbitrary code execution based on current information, memory disclosure within the sandbox can facilitate further exploitation or information theft. The scope is limited to Chrome on Android; desktop platforms (Windows, Mac, Linux) are not listed as affected by this specific CVE (Feedly, Chrome Releases).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation for CVE-2026-113341 (Feedly). The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.0, reflecting low current exploitation probability. No threat actor attribution has been reported. Exploitation requires luring a target Android Chrome user to a malicious or attacker-controlled web page, making it a drive-by scenario with no required user interaction beyond page navigation.

Google has released a patch in Chrome version 156.0.8078.47 for Android (and 156.0.8078.47/.48 for Windows/Mac) that addresses this vulnerability (Chrome Releases). Users should update Google Chrome on Android to version 156.0.8078.47 or later immediately via the Google Play Store. As a supplementary measure, organizations should consider restricting access to untrusted web content and implementing content security policies where feasible. No configuration-based workaround has been published by Google.

The vulnerability was noted by security news outlets and community aggregators shortly after disclosure. SecurityOnline.info covered the Chrome 156 security update, and the Infosec.exchange Mastodon community (@DailyCyberSecurity) highlighted the release (Feedly). No significant independent researcher commentary or vendor statements beyond the official Google Chrome release advisory have been identified at this time.