Google Chrome CVE-2026-112992

Exploitation requires a victim using Google Chrome prior to 156.0.8078.47 to load an attacker-controlled HTML page that exercises the vulnerable Canvas rendering path - the crafted page IS the required condition. Per CVSS UI:R, user interaction (navigating to or viewing the malicious page) is mandatory, which limits exploitation to social-engineering, malvertising, or compromised-site delivery rather than fully unattended remote attack. PR:N means no authentication is required. The meaningful additional barrier is achieving a reliable sandbox escape (S:C), which in practice raises exploit complexity beyond a renderer-only crash despite the AC:L rating.

CVSS 3.1 scores this 9.6 Critical (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting network-reachable, low-complexity, unauthenticated exploitation requiring only that a victim load a crafted HTML page, with a scope change (S:C) that captures the sandbox escape and full confidentiality/integrity/availability impact. However, Google's own Chromium security team rated the issue 'Medium', a notable divergence from the 9.6 - this gap typically reflects Chromium's internal weighting of exploit reliability and the user-interaction requirement, so treat the 9.6 as the upper-bound severity rather than a settled consensus; verify severity intent with the vendor advisory. No EPSS score, SSVC decision, KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent exploitation. The tags RCE and Buffer Overflow are consistent with CWE-119 and the 'memory corruption … execute arbitrary code outside the sandbox' description. Net assessment: a genuinely serious sandbox-escape class bug in a ubiquitously deployed browser warranting prompt patching, but current real-world exploitation signals (EPSS/KEV/POC) are absent, suggesting this is a patch-on-cycle priority rather than a confirmed emergency - reassess immediately if a POC or KEV entry appears.

An attacker hosts or compromises a web page containing malicious canvas rendering content and lures a victim running a vulnerable Chrome build to visit it. The crafted HTML triggers memory corruption in the Canvas component, and because the flaw permits code execution outside the sandbox (scope change), successful exploitation could yield arbitrary code execution on the victim's host. No public exploit code was identified in the provided data at time of analysis.