Chromium Downstreams Need More Than the Desktop Chrome Version Check

CVE-2026-113008 is filed against Google Chrome, but the vulnerable code sits in Chromium's Autofill path. Distributors, browser forks, and Electron-like products can share source ancestry without sharing a release number. A fixed desktop Chrome build is therefore a strong signal, not proof that every downstream product is patched.

The CNA lists Google Chrome before 156.0.8078.47 as affected. Google's stable update supplied 156.0.8078.47 for Linux and 156.0.8078.47/.48 for Windows and macOS. The Chromium issue describes stale AutofillExternalDelegate::last_query_ state and a race in Transactions Platform. The fix replaces the mutable destination with FormGlobalId and FieldGlobalId values bound to the suggestion callback.

Why a fork can diverge

A downstream project may merge Chromium security patches on a different schedule, backport the source change without adopting the same version string, or disable the affected feature entirely.…