Google Chrome CVE-2026-113019

Exploitation requires a victim using Chrome prior to 156.0.8078.47 to open an attacker-crafted HTML page (UI:R, user interaction mandatory) - this is the primary limiting factor, as no exploitation occurs without the victim navigating to malicious content. No authentication is required (PR:N) and no non-default configuration or special feature toggle is named in the description; the UAF resides in the Turbolev component and is reachable against default Chrome. The key factor that LIMITS real-world impact is that successful code execution is confined to the renderer sandbox, so attaining full host compromise additionally requires chaining a separate sandbox-escape vulnerability not covered by this CVE.

This is a genuine priority for any environment running Google Chrome, but with an important nuance that tempers the headline CVSS 8.8. The CVSS vector (AV:N/AC:L/PR:N/UI:R) describes a remote, low-complexity, unauthenticated attack requiring only that a victim open a crafted HTML page - a trivially achievable condition for a browser. However, the description explicitly states code execution occurs 'inside the sandbox,' meaning the impact (C:H/I:H/A:H, S:U) is confined to the compromised renderer process; full host compromise would require chaining a separate sandbox-escape bug, which this CVE does not provide. Chromium rates the severity 'High' (not Critical), consistent with a sandboxed-renderer UAF. On the exploitation-signal side there is NO conflict to resolve because the data is simply absent: no CISA KEV listing, no EPSS score, and no POC are provided in the input, so there is no public exploit identified at time of analysis. The SSVC/automatable and EPSS dimensions cannot be evaluated from the given data. Net assessment: patch promptly because the product is ubiquitous and the memory-corruption bug class is reliably weaponizable by sophisticated actors, but in the absence of KEV/POC/EPSS signals this is a proactive-hygiene priority rather than a confirmed active-exploitation emergency.

A remote attacker hosts or compromises a web page containing malicious HTML that triggers the use-after-free in the Turbolev component. When a victim running a vulnerable Chrome build (prior to 156.0.8078.47) visits the page, the freed object is reclaimed with attacker-controlled data, yielding arbitrary code execution within the renderer sandbox. Because the flaw is low-complexity and needs only a page visit, it is well suited to watering-hole or malvertising delivery, though no public exploit is identified at time of analysis and full system compromise would require an additional sandbox escape.