Google Chrome CVE-2026-113013

Exploitation requires the victim to load attacker-controlled HTML that exercises the Chrome DevTools code path, so DevTools functionality must be engaged for the crafted page to trigger the memory corruption. No authentication is needed (PR:N confirmed by CVSS), but user interaction is required (UI:R) - the victim must be induced to open the malicious page. The most important limiting factor is that successful exploitation yields code execution only INSIDE the Chromium sandbox (S:U, vendor-confirmed), not on the host; absent a separate sandbox-escape the attacker cannot reach the operating system, which is why Chromium rates the issue Low. Affected builds are Chrome versions prior to 156.0.8078.47, so patched installations are not exploitable.

Signals conflict sharply here and that tension is the core of the assessment. The NVD CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which on its face suggests a remotely triggerable, low-complexity, no-privilege arbitrary-code-execution bug. However, Google/Chromium explicitly rates this a LOW severity issue, and the description is the reason: the memory corruption in DevTools allows code execution 'inside the sandbox' via a crafted HTML page. This is a sandboxed renderer-level compromise, NOT a sandbox escape - the scope is Unchanged (S:U), consistent with the attacker remaining confined to the Chromium sandbox and NOT gaining host-level code execution. That gap between an 8.8 numeric score and a vendor 'Low' rating should be treated as a real divergence, not a scoring error: by itself this flaw does not breach the security boundary that protects the operating system, so in practice it would need to be chained with a separate sandbox-escape vulnerability to achieve meaningful host impact. On exploitation maturity, there is no public exploit identified at time of analysis - the CVE is not listed in CISA KEV, no POC is referenced, and no EPSS value is supplied in the input, so exploitation probability cannot be quantified from the data given. Authentication requirements are confirmed from the CVSS vector (PR:N = unauthenticated), but exploitation requires user interaction (UI:R) - the victim must open or be lured to a crafted page. SSVC-style framing is not provided in the input and cannot be reconstructed reliably. Net judgment: despite the High CVSS number, this is a lower-priority issue in isolation because it yields only sandboxed execution; it becomes a genuine priority only as one link in an exploit chain, and no active-exploitation or POC signal elevates it today.

A remote, unauthenticated attacker lures a victim who has Chrome DevTools in use into visiting a crafted HTML page, which triggers the DevTools memory-corruption bug and executes attacker-controlled code within the renderer sandbox. No public exploit is identified at time of analysis, and because execution is confined to the sandbox, a realistic attack would pair this with a separate sandbox-escape to reach the host. Low complexity (AC:L) but requires user interaction (UI:R) to deliver the malicious page.