Google Chrome CVE-2026-113056

Exploitation requires a victim running Google Chrome prior to 156.0.8078.47 to load attacker-controlled web content - specifically a crafted HTML page that exercises the PerformanceAPIs (the W3C Performance timing/measurement JavaScript interfaces) to trigger the CWE-119 memory corruption (UI:R, so the user must visit or be redirected to the page). No authentication or special privileges are needed (PR:N). Key limiting factors: the attack needs user interaction (navigation to the malicious page), affects only unpatched Chrome builds, and the claimed sandbox escape is qualified as 'potentially' and rated only 'Low' by Chromium, indicating reliable arbitrary code execution outside the sandbox may not be practically achievable; no non-default configuration is required.

The signals here conflict sharply and must be reconciled before prioritization. The input CVSS base score of 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw that escapes the Chrome sandbox (S:C) with full confidentiality, integrity and availability impact - on paper a critical, high-priority issue. However, Google/Chromium's own assigned security severity is 'Low', and the description hedges with 'potentially execute arbitrary code outside the sandbox.' This is a significant and explicit discrepancy: a genuine, reliable renderer-to-host sandbox escape is normally rated Critical/High by Chromium, so the 'Low' rating strongly implies the memory corruption is hard to reliably weaponize into a working sandbox escape (e.g., limited control over the corruption, mitigations in place, or impact confined in practice) - verify with the vendor advisory. No EPSS score, no CISA KEV listing, and no POC indicator are present in the input, so there is no evidence of active exploitation or public exploit code; exploitation status is 'no public exploit identified at time of analysis.' Net assessment: despite the headline 9.6, the vendor's 'Low' severity, the 'potentially' qualifier, the required user interaction (UI:R), and the absence of KEV/EPSS/POC signals suggest this is a lower real-world priority than the CVSS number alone implies - a browser flaw to patch on the normal Chrome auto-update cadence rather than an emergency. Because Chrome is ubiquitous, patch rollout breadth still matters even if per-instance exploitation risk is modest.

An attacker hosts or compromises a web page containing crafted content that triggers the PerformanceAPIs memory-corruption bug when a victim using a vulnerable Chrome build (prior to 156.0.8078.47) visits it. Successful exploitation could corrupt renderer memory and potentially chain to code execution outside the browser sandbox on the victim's host, though the vendor's 'Low' severity rating and 'potentially' wording suggest reliable sandbox escape is uncertain. No public exploit code is identified in the available data.