Google Chrome CVE-2026-113016

Exploitation requires the victim to open attacker-controlled web content: a crafted HTML page that triggers the improper input validation in Chrome's Extensions component (UI:R - the attack does not fire without a user navigating to the page). It affects Google Chrome desktop builds prior to 156.0.8078.47 and requires no authentication (PR:N) or special non-default configuration per the data provided. The key limiting factor is that resulting code execution is confined to the browser sandbox (S:U, Chromium 'Medium' severity); achieving host-level compromise would require chaining this with a separate sandbox-escape vulnerability, which materially reduces standalone impact.

Signals are mixed and should temper the headline score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a remote, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - a classic drive-by browser profile. However, the Chromium team rated the security severity 'Medium', and the description scopes impact to code execution INSIDE the sandbox (S:U, no scope change to the host OS), so this is not a full renderer-to-system compromise on its own and would typically need to be chained with a sandbox-escape to achieve host RCE. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization - exploitation status is 'no public exploit identified at time of analysis'. Net: patch promptly because of Chrome's ubiquity and the trivial UI:R trigger, but the 8.8/High vs Chromium-Medium divergence and the sandbox-only impact suggest real-world risk is lower than the raw CVSS implies absent a chained sandbox escape. Note the discrepancy explicitly: CVSS C:H/I:H/A:H reflects full compromise of the sandboxed renderer process, not the underlying system.

An attacker hosts or injects a malicious HTML page (via a controlled site, malvertising, or compromised third party) that abuses the improper input validation in Chrome's Extensions component. When a victim running a vulnerable Chrome build (prior to 156.0.8078.47) visits the page, the attacker achieves arbitrary code execution within the browser sandbox. No public exploit code was identified at the time of analysis.