Google Chrome CVE-2026-112993

Exploitation requires the victim to load attacker-controlled HTML in a vulnerable Chrome build (prior to 156.0.8078.47) - i.e. user interaction (UI:R) in the form of visiting a malicious or compromised web page; no authentication or special privileges are needed (PR:N). The flaw affects the default browser configuration with no special feature or setting required. Key limiting factors: (1) the user must actively navigate to the malicious content, and (2) code execution is confined to the renderer sandbox (S:U), so meaningful compromise of the host requires chaining a separate sandbox-escape; auto-update also rapidly shrinks the exposed population.

This is a genuine high-priority issue for any environment running Google Chrome, though the signals are nuanced. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a remotely-reachable, low-complexity, unauthenticated flaw requiring only that a victim visit a crafted HTML page - a realistic condition for a browser. The 8.8 score and C:H/I:H/A:H impact are consistent with a use-after-free (CWE-416) that yields arbitrary code execution. A critical mitigating factor is explicit in the description: execution occurs INSIDE the Chrome sandbox (S:U, scope unchanged), so absent a chained sandbox-escape this does not by itself grant host compromise - the C:H/I:H/A:H rating reflects full control of the renderer process, not the underlying OS. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis; the risk here is driven by ubiquity and the ease of the delivery vector, not by evidence of active exploitation. Note the signal gap: the vendor rates this 'High' (not Critical), and real-world weaponization of a sandboxed renderer UAF typically requires a second bug - treat as a priority patch due to Chrome's footprint rather than evidence of imminent mass exploitation.

An attacker hosts or compromises a web page containing malicious HTML/JavaScript that triggers the use-after-free in Chrome's Input component. A victim running a pre-156.0.8078.47 build simply visits the page (UI:R), and the attacker achieves arbitrary code execution within the renderer sandbox. No public proof-of-concept was identified in the provided data; full host compromise would require chaining an additional sandbox-escape vulnerability.