Google Chrome CVE-2026-113012

Exploitation requires the victim to use a Google Chrome desktop or ChromeOS build prior to 156.0.8078.47 and to actively load an attacker-controlled HTML page (UI:R), after which the GPU component's improper input validation is triggered; no authentication or special privileges are needed (PR:N). The principal limiting factors are: (1) mandatory user interaction - the victim must visit or be redirected to the malicious page; (2) resulting code execution is confined to the browser sandbox, so standalone impact on the host is limited absent a separate sandbox-escape vulnerability; and (3) users on the patched build 156.0.8078.47 or later are not affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw that requires user interaction, which is consistent with the description: a victim must load a crafted HTML page. This is a real priority for any browser-exposed environment, but two signals temper the raw 8.8. First, the description explicitly states code execution occurs 'inside the sandbox' (S:U, scope unchanged), meaning this is a sandbox-contained RCE that would typically need to be chained with a sandbox-escape bug to achieve full host compromise - the C:H/I:H/A:H reflects impact to the GPU/renderer process boundary, not necessarily the underlying OS. Second, there is no EPSS score, no CISA KEV listing, and no indication of public exploit code in the provided data, so there is no evidence of active exploitation - status is 'no public exploit identified at time of analysis.' Chromium rates the severity High, aligning with the CVSS. No signals directly conflict; the main caveat is that the 8.8 overstates standalone impact because exploitation is sandbox-confined and gated by user interaction.

An attacker hosts a malicious web page containing crafted content that triggers the improper input validation (CWE-20) in Chrome's GPU component. A victim running a vulnerable Chrome build (prior to 156.0.8078.47) visits the page, and the attacker gains the ability to execute arbitrary code within the browser sandbox. No public proof-of-concept or active exploitation is identified in the available data; a full compromise would additionally require a sandbox escape.