Google Chrome CVE-2026-113038

Exploitation requires a victim to load attacker-controlled crafted HTML in Google Chrome versions prior to 156.0.8078.47 (UI:R - user must visit/open the malicious page); it cannot be triggered without this interaction. The flaw resides in the DevTools component and yields only an in-sandbox memory read, so impact is limited to confidentiality disclosure of data accessible within the renderer sandbox - it does not by itself achieve sandbox escape, code execution, or persistence. The primary limiting factors are the required user interaction and the sandbox containment of the leaked data; no authentication is required (PR:N) and no non-default configuration is needed, as DevTools ships with Chrome.

This is a genuinely lower-tier Chrome vulnerability despite a moderate 6.5 CVSS base score, and the signals are internally consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (visiting a page) and produces only a confidentiality impact (C:H) with no integrity or availability effect and no scope change - meaning the defect leaks memory but does NOT escape the renderer sandbox. Google itself rated the Chromium security severity as Low, which aligns with the limited, sandbox-contained read primitive. EPSS corroborates low real-world urgency: 0.22% probability at the 12th percentile. There is no CISA KEV listing and no public exploit identified in the provided data, so there is no evidence of active exploitation. No SSVC decision data was provided. The only mild tension is the C:H rating against a vendor 'Low' severity - this reflects that an in-sandbox memory read, while high-impact for confidentiality in the abstract, is operationally constrained because the leaked data stays within the renderer sandbox and still requires luring a user to a malicious page. Bottom line: patch it on the normal Chrome auto-update cadence; it is not an emergency-priority issue.

An attacker hosts or compromises a web page containing crafted HTML that triggers the DevTools memory-corruption condition when rendered, and lures a victim into opening it. The resulting out-of-bounds read lets the attacker potentially recover sensitive memory contents (e.g., data from other pages or process memory) from within the renderer sandbox. No public exploit code was identified at the time of analysis, and user interaction is required.