Google Chrome CVE-2026-113002

Exploitation requires the victim to actively load an attacker-controlled or attacker-injected crafted HTML page in an unpatched Chrome build prior to 156.0.8078.47 (UI:R) - there is no server-side or passive network attack path. No authentication is required (PR:N). The primary limiting factors are: (1) mandatory user interaction (navigating to the malicious page), and (2) impact is confined to reading memory inside the renderer sandbox (S:U, no sandbox escape), yielding information disclosure only with no code execution, data modification, or denial of service. This is not exploitable against default configurations without user navigation to malicious content.

This is a genuinely moderate-priority issue rather than an overhyped high-CVSS finding, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (visiting a crafted HTML page) and yields only confidentiality impact with no integrity or availability effect. Critically, the description constrains the impact further: it allows reading memory ONLY inside the Chrome sandbox, which Google's own 'Medium' Chromium severity rating reflects - this is an information-disclosure primitive confined to a sandboxed renderer, not a sandbox escape or RCE. EPSS is low (0.22%, 12th percentile), there is no CISA KEV listing, and no public exploit code was identified, so all exploitation signals point to low near-term mass-exploitation likelihood. The confidentiality rating of C:H in the supplied vector is arguably generous given the sandbox confinement and the 'potentially read' phrasing; the disclosure is bounded to in-sandbox memory, which tempers real-world severity. No signals conflict, but note the gap between a C:H CVSS confidentiality score and a vendor 'Medium' rating.

An attacker hosts a malicious web page (or injects malicious content via a compromised ad/iframe) and lures a victim running an unpatched Chrome build into visiting it. The crafted HTML triggers memory corruption in Chrome's Transactions Platform component, letting the attacker read adjacent memory within the renderer sandbox and potentially exfiltrate sensitive in-process data. No public proof-of-concept exploit was identified at time of analysis, and exploitation requires the user to load the attacker-controlled page.