Google Chrome CVE-2026-113040

Exploitation requires the victim to actively visit or load an attacker-controlled crafted HTML page in a vulnerable Chrome build (before 156.0.8078.47) - this user interaction (UI:R) is the primary limiting factor; there is no standalone remote trigger against an idle browser. No authentication or special privileges are needed (PR:N), and the flaw appears reachable against default configurations since it resides in core Proxy handling rather than an opt-in feature. The key mitigating limit is scope: resulting code execution is confined within Chrome's sandbox (S:U), so without an additional sandbox-escape chain the attacker does not gain host-level control.

This is a credible high-priority browser vulnerability but not an emergency at the time of analysis. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates a remote, low-complexity, unauthenticated attack that requires user interaction (visiting a crafted page) and yields high confidentiality, integrity, and availability impact. Critically, the code execution is confined 'inside the sandbox' (Scope:Unchanged), which materially reduces real-world risk versus a sandbox-escape RCE - an attacker gains code execution in a renderer/child process, not on the host, so full compromise would require chaining a separate sandbox-escape bug. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there is no positive signal of active or imminent exploitation. Google rates the Chromium severity 'High' (not Critical), consistent with the sandbox-contained impact. Net: patch promptly given Chrome's ubiquity and the low attack complexity, but there is no evidence this is being exploited, and the sandbox containment means isolated exploitation is less damaging than the raw 8.8 suggests.

An attacker hosts or compromises a web page containing crafted HTML that triggers the improper input validation in Chrome's Proxy handling, then lures a victim into visiting it (malvertising, phishing link, or compromised site). When the page loads, the flaw allows the attacker to execute arbitrary code within the browser's sandboxed renderer process. No public exploit code was identified at time of analysis.