Google Chrome CVE-2026-110913

Exploitation requires the victim to actively load a crafted HTML page in a vulnerable Chrome build prior to 155.0.8059.84 - the UI:R metric means user interaction (navigating to attacker-controlled content) is mandatory, which is the primary limiting factor. No authentication or special privileges are needed (PR:N), and it works against default Chrome configurations with no non-default feature required. The key containment is that resulting code execution is confined to the renderer sandbox (scope Unchanged); escaping to the host or achieving persistence requires an additional, separate sandbox-escape vulnerability not covered by this CVE.

Signals are largely consistent and point to a genuine but not emergency-level priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim visit a crafted HTML page - a classic drive-by renderer bug - yielding high confidentiality, integrity, and availability impact (C:H/I:H/A:H) for a base score of 8.8. Critically, the description states code executes 'inside the sandbox,' and scope is Unchanged (S:U), so this is renderer-level compromise with no confirmed sandbox escape; full host takeover would require chaining a separate escape. Exploitation maturity signals are low: there is no CISA KEV listing and no public POC, so this is 'no public exploit identified at time of analysis,' and CISA SSVC concurs with Exploitation: none and Automatable: no - meaning no evidence of mass or automated exploitation despite the Technical Impact: total rating (which reflects the within-sandbox code execution, not host control). The main tension is that a high base severity and ubiquitous attack surface (Chrome) coexist with no current exploitation evidence; the UI:R requirement and sandbox containment are the practical mitigating factors. Treat as a standard high-priority browser patch rather than a zero-day fire drill, but patch promptly given Chrome's footprint and the history of such DOM bugs being chained.

An attacker hosts or compromises a web page containing malicious HTML/JavaScript that triggers the DOM memory-corruption bug, then lures a user to visit it via a link, ad, or injected content. When the page loads, the attacker achieves arbitrary code execution within the Chrome renderer sandbox on the victim's machine. No public exploit is currently identified, and full system compromise would require chaining an additional sandbox-escape vulnerability.