Google Chrome CVE-2026-112998

Exploitation requires the victim to visit or be redirected to attacker-controlled crafted HTML while running an affected Chrome desktop build prior to 156.0.8078.47 - i.e., user interaction (UI:R) is mandatory, so there is no zero-click or server-side path. No authentication is required (PR:N). The critical limiting factor is that the resulting arbitrary code execution is confined to the renderer sandbox (per the description and Chromium's Low rating); without a separate, un-described sandbox-escape vulnerability, the attacker cannot execute code on the host OS or access other origins, which sharply reduces real-world impact relative to the 8.8 score.

The input presents a notable conflict that must drive prioritization: the NVD CVSS 3.1 base score is 8.8 (High) with a fully network-exploitable vector (AV:N/AC:L/PR:N/UI:R) and High confidentiality, integrity, and availability impacts, yet Google's own Chromium security team rated this 'Low' severity, and the description explicitly scopes the arbitrary code execution to 'inside the sandbox.' This gap is the key signal: a memory-corruption RCE confined to the renderer sandbox is materially less dangerous than the 8.8 score implies, because the attacker gains code execution in a confined process and still needs a separate sandbox-escape chain to affect the host or other sites. No EPSS score was provided, so exploitation probability cannot be quantified. KEV status is not listed (no CISA KEV entry), and no POC was supplied, so per the rules this is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. Net assessment: this is a patch-on-normal-cadence browser bug rather than an emergency - the high CVSS overstates real-world risk given the vendor's Low rating and the sandbox confinement, and there is no evidence of active exploitation or available exploit code. It becomes a genuine priority only if later chained with a sandbox escape, which is not indicated in the current data.

A remote attacker hosts or compromises a web page containing crafted HTML that triggers the Views memory-corruption flaw when a victim using a vulnerable Chrome build (prior to 156.0.8078.47) visits it. Successful exploitation yields arbitrary code execution confined to the browser's renderer sandbox; absent a chained sandbox escape, the attacker cannot directly reach the underlying OS. No public exploit code was identified in the provided data.