Chrome for Android CVE-2026-113055

Exploitation requires the victim to open a specifically crafted HTML page in a vulnerable Chrome for Android build (prior to 156.0.8078.47) that triggers the FullScreen type-confusion condition; no authentication is required (PR:N) but user interaction is mandatory (UI:R), since the attacker cannot force exploitation without the user visiting attacker-controlled content. The key limiting factors are: (1) resulting code execution is confined to the renderer sandbox (S:U) - no device-level compromise without a separate sandbox-escape chain; (2) it affects only the Android Chrome client at versions below the fixed release; and (3) it depends on luring the user to malicious or compromised web content rather than any server-side or default-on exposure.

Multiple signals point to a genuine but moderated priority. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 HIGH) describes network-reachable, low-complexity exploitation with no privileges but requiring user interaction (visiting a crafted page). Importantly, Google rated the Chromium security severity as only MEDIUM, and the description states code execution occurs INSIDE the sandbox (S:U, scope unchanged) - meaning a sandbox escape is NOT part of this bug, which materially limits real-world impact versus the 8.8 score alone. This is the classic gap between a high NVD CVSS and the vendor's more conservative rating. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation: no public exploit identified at time of analysis. No SSVC decision data was supplied. Net: a real memory-corruption RCE worth patching on normal Chrome cadence, but absent sandbox escape, KEV, or POC it is not an emergency - treat as routine browser patching rather than drop-everything. One data caveat: the only non-Chromium reference points to a DESKTOP stable-channel blog post while the CVE text specifies Android, so the exact advisory URL should be verified against the Android release notes.

A victim using Chrome for Android (before 156.0.8078.47) is lured to a malicious or compromised website that serves a crafted HTML page exploiting the FullScreen type-confusion flaw (CWE-843), triggering arbitrary code execution within the renderer sandbox. Exploitation is remote and low-complexity but requires the user to visit the page (UI:R); code runs confined to the sandbox, so additional chained escapes would be needed for full device compromise. No public exploit code was identified at time of analysis.