External risk intelligence

Google Chrome PrintPreview Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-113089

The vulnerability exists within the PrintPreview feature of a web browser (Google Chrome). This is a client-side component that is not a public-facing service, API, or network gateway. Exploitation requires user interaction with a crafted HTML page within the browser environment, making it a local, client-side execution risk rather than a publicly reachable network attack surface.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in the PrintPreview feature of Google Chrome. This flaw, if exploited, could allow an attacker to execute code on a user's system by luring them to a malicious webpage. The main concern is confirming if this specific feature is used within the organization and understanding the potential exposure.

Flaw lets malicious websites run code in Chrome.
Confirms if this feature is used and potential exposure.
Understand and confirm potential exposure of this feature.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious website, which would then trigger a vulnerability in Chrome's PrintPreview feature. This could allow the attacker to execute code on the user's computer, potentially leading to broader system compromise.

Requires user interaction with a crafted page.
Vulnerability within the PrintPreview feature.
Potential for arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

The PrintPreview feature in Google Chrome could allow an attacker to execute code outside the browser's sandbox when a user visits a specially crafted HTML page. This could potentially affect the integrity and confidentiality of data and system resources accessible to the browser process.

Arbitrary code execution outside sandbox.
User visits malicious HTML page.
Compromise of user data and system.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides in a client-side browser component, PrintPreview, which requires user interaction with a malicious HTML page for exploitation. Ownership will likely fall to teams managing end-user computing environments, including desktop support, endpoint security, and potentially application owners if custom web applications leverage this feature. The immediate priority is to confirm the presence of affected browser versions on user endpoints and assess the risk based on user behavior and the potential for users to encounter malicious web content.

End-user computing teams own remediation.
Verify affected browser versions on endpoints.
Plan coordinated updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome PrintPreview?

Google Chrome is a widely used web browser that renders HTML content. PrintPreview is an integrated component within this browser that allows users to view and adjust documents before sending them to a printer. It functions as part of the client-side software environment to translate web content into a printable format, managing the interface and settings required for document output.

What does CVE-2026-113089 mean?

This CVE indicates a vulnerability classified as improper input validation (CWE-20). In simple terms, the PrintPreview feature fails to properly check or sanitize the data it receives from a webpage. Because of this weakness, the browser can be tricked into processing malicious instructions, potentially allowing that code to break out of the browser's normal security restrictions and run directly on your computer.

How is this vulnerability triggered?

An attacker must lure a user to a specially crafted HTML page. The trigger requires active user interaction, specifically visiting that malicious site. Simply having the browser installed or running in the background does not trigger the bug; the code execution only becomes possible when the PrintPreview component processes the malicious content provided by the page the user has navigated to.

Is this a risk for my servers or just desktops?

According to Halo Surface Signal, this is a client-side risk rather than a publicly reachable network service. Because it resides in the browser's PrintPreview feature, it is unlikely to impact servers or network gateways. The concern is focused on end-user machines where individuals might browse the web and inadvertently interact with malicious content.

What should I do to address this?

The primary response is to update Google Chrome to version 156.0.8078.47 or later. Since this is a browser-based component, desktop support and endpoint security teams should prioritize verifying that end-user devices are running the patched version. Coordinate these updates through your standard software management procedures to ensure all browser instances are protected.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.