Google Chrome CVE-2026-113035

Exploitation requires the victim to use an unpatched Chrome build prior to 156.0.8078.47 and to actively navigate to attacker-controlled or attacker-injected HTML content (UI:R - the crafted page must be loaded; this is not wormable without user navigation). No authentication or elevated privileges are needed (PR:N), and default Chrome configurations are affected since no special feature toggle or non-default mode is named in the advisory. Limiting factors: impact is bounded to reading memory WITHIN the renderer sandbox (not a sandbox escape, code execution, or integrity/availability impact), the read is described as only 'potential,' and the user-interaction requirement prevents drive-by exploitation without luring the target to a page.

This is a genuine but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (visiting a crafted page) and affects confidentiality only. The signals are consistent and point AWAY from urgency: EPSS is very low (0.22%, 11th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data. Google itself rated the Chromium security severity as Medium, which aligns with the description's key limiting phrase - the memory read is confined 'inside the sandbox,' so this is not a sandbox escape or RCE. One mild tension to verify: the official vector asserts C:H, yet the description says the attacker can only 'potentially read memory inside the sandbox,' which suggests a more constrained, probabilistic disclosure than full high-confidentiality impact. Overall this is a patch-in-normal-cycle browser bug, not an emergency; the main real-world risk driver is simply Chrome's enormous install base, not the likelihood or impact of this specific flaw.

An attacker hosts or compromises a web page containing specially crafted HTML that triggers the out-of-bounds read in the vulnerable Chrome API. A user with an unpatched Chrome (before 156.0.8078.47) visits the page, and the attacker's script potentially reads adjacent sandbox memory, which could leak data useful for defeating ASLR or chaining with a second bug. No public proof-of-concept was identified at time of analysis, and user interaction (navigating to the page) is required.