Google Chrome CVE-2026-113003

Exploitation requires the victim to load attacker-controlled web content (UI:R) that exercises Chrome's HID (Human Interface Device / WebHID) processing in versions prior to 156.0.8078.47; no authentication is required (PR:N). The key limiting factor is containment: the description states code runs INSIDE the sandbox, so arbitrary code execution is confined to the sandboxed renderer and does not by itself yield host compromise without an additional sandbox-escape vulnerability. User interaction (visiting/interacting with the malicious page) is mandatory, and users on auto-updated Chrome at or above 156.0.8078.47 are not affected.

This is a genuine high-priority patch item, though with important nuance. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated bug requiring only that a victim visit a crafted HTML page - a trivially met condition for a web browser. However, the description explicitly states code executes 'inside the sandbox,' meaning a separate sandbox-escape bug is needed for full host compromise; the scope is correctly marked Unchanged (S:U). This creates a notable signal conflict: the CVSS base score of 8.8 and the vendor's 'Chromium security severity: Medium' rating diverge, precisely because CVSS does not credit the sandbox as a mitigating boundary while Google's internal rating does. No EPSS score was provided, so exploitation-probability modeling is unavailable. KEV status is not indicated (treat as not listed) and no POC is referenced, so there is no evidence of active exploitation or public exploit code. SSVC inputs (automatable, exploitation status) were not supplied. Net assessment: real priority due to ubiquity and remote reachability, but the sandbox containment and absence of exploitation signals place it below a drop-everything emergency - standard rapid Chrome auto-update cadence addresses it.

An attacker hosts or injects a malicious HTML page (e.g., via a compromised ad network or phishing link) that drives the browser's HID (WebHID/USB Human Interface Device) code path to trigger the memory corruption. When a victim running an unpatched Chrome visits the page, the attacker achieves arbitrary code execution confined to the renderer/sandbox process. No public exploit was identified at time of analysis, and realistic full-system compromise would require chaining a separate sandbox escape.