Google Chrome CVE-2026-113020

Exploitation requires the victim to open an attacker-controlled (crafted) HTML page in a vulnerable Chrome build prior to 156.0.8078.47 - this user interaction (UI:R) is the primary limiting factor; no authentication or privileges are needed (PR:N). No special non-default Chrome configuration is indicated by the description - the Date input-validation flaw is in core browser functionality, so default installations are affected. The realistic barrier is social-engineering the target into visiting malicious web content and the typical need to chain past Chrome's sandbox for the 'outside the sandbox' code execution; patched builds (156.0.8078.47+) and ChromeOS/desktop channel updates remove the condition.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes a network-reachable, low-complexity, unauthenticated flaw that changes scope (S:C) - consistent with the description's claim of arbitrary code execution OUTSIDE the Chrome sandbox, which is the most serious class of browser bug. The only brake on the score is UI:R: the victim must open attacker-controlled web content. Chromium rated the security severity High, and a vendor patch is already available (fixed in 156.0.8078.47). Key exploitation signals are MISSING from the input: no EPSS probability was provided, the CVE is NOT in CISA KEV, and no public POC is referenced, so this is best treated as no public exploit identified at time of analysis. Note a tension to verify: the input Tags include 'RCE' and the description says 'potentially execute arbitrary code outside the sandbox,' but the CWE is CWE-20 (Improper Input Validation) in the Date component - the path from an input-validation bug in Date to a full sandbox escape is not detailed in the data and typically requires chaining, so the 'arbitrary code' outcome is vendor-characterized potential rather than independently demonstrated here. Given Chrome's ubiquity and the sandbox-escape impact, patching should be prioritized despite the absence of confirmed exploitation.

An attacker hosts a crafted HTML page that abuses improper input validation in Chrome's Date handling and lures a victim to visit it (e.g., via phishing link or malicious ad). Because the flaw can lead to code execution outside the renderer sandbox, successful exploitation could give the attacker control on the victim's host rather than just within the browser. No public exploit code is referenced in the provided data, so this remains a potential rather than demonstrated attack path.