Google Chrome CVE-2026-113011

Requires the victim to be running Google Chrome on Windows prior to 156.0.8078.47 and to load attacker-controlled content - specifically a crafted HTML page that exercises the CredentialProvider component to trigger the use-after-free (UI:R: user must open/visit the page). No authentication or special privileges are needed (PR:N). The principal limiting factor is sandbox containment: successful exploitation yields code execution only inside the Chrome renderer sandbox (S:U), so converting this into host-level compromise requires chaining an additional sandbox-escape vulnerability. Exploitation is confined to the Windows platform per the advisory.

Multiple signals must be weighed carefully here. The NVD CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R) frames this as a high-severity, network-reachable, unauthenticated flaw needing only that a user open a crafted HTML page - a trivially met condition for a web browser. However, this directly conflicts with Google/Chromium's own rating of 'Medium' severity, and the conflict is resolved by the description itself: the use-after-free in CredentialProvider allows code execution ONLY 'inside the sandbox' (S:U, no scope change). A single sandboxed renderer-level RCE is not equivalent to full host compromise; it would need to be chained with a separate sandbox-escape bug to become a practical system takeover, which is why Chromium rates it Medium despite the high NVD vector. On exploitation signals: there is no CISA KEV listing and no public exploit code referenced in the provided data, so this is NOT confirmed actively exploited. No EPSS score was supplied, and no SSVC decision data was provided, so automatability and exploitation-status cannot be assessed from these inputs. Net judgment: this is a legitimate patch-now item for any Chrome fleet because of ubiquity and ease of trigger, but it is a sandbox-confined memory-corruption bug rather than a confirmed, standalone, in-the-wild host-compromise threat - treat it as routine high-priority browser patching, not an emergency breach scenario. The C:H/I:H/A:H impact in the NVD vector appears to describe worst-case renderer-process impact and overstates real-world outcome given sandbox containment.

An attacker hosts or compromises a web page containing crafted HTML/JavaScript that triggers the use-after-free in Chrome's CredentialProvider; a victim running a vulnerable Chrome build on Windows simply visits the page (UI:R satisfied). The dangling-pointer condition is exploited to achieve arbitrary code execution within the renderer sandbox. No public proof-of-concept or exploit code is identified in the provided data, and full system compromise would additionally require chaining a separate sandbox-escape vulnerability.