Google Chrome CVE-2026-113063

Requires a victim running Google Chrome prior to 156.0.8078.47 to actively visit an attacker-controlled crafted HTML page (UI:R), which exercises the Chromoting / Chrome Remote Desktop input-validation path. The decisive LIMITING factor is that resulting code execution is confined to the browser sandbox - the description describes no sandbox escape, so an attacker does not obtain host-level code execution from this flaw alone. User interaction (navigation to the malicious page) is mandatory, and the issue is remediated by updating to 156.0.8078.47 or later.

Signals conflict sharply and must be reconciled before prioritizing. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, unauthenticated, low-complexity flaw with full High impact, which on its face looks urgent. However, the description explicitly states code execution occurs 'inside the sandbox' and Google's own Chromium security team rated the severity as Low - a strong indicator that real-world impact is contained by the renderer/sandbox boundary and does not by itself yield host compromise. No EPSS score was provided, the vulnerability is NOT in CISA KEV, and no public POC is referenced, so there is no public exploit identified at time of analysis. Net assessment: this is a patch-on-normal-cadence browser issue, not an emergency. The headline 8.8 overstates practical risk because the full-High impact metrics ignore the sandbox confinement that Chromium's 'Low' rating reflects; absent a chained sandbox-escape (not described here), an attacker gains only sandbox-confined execution.

An attacker hosts a malicious web page and lures a Chrome user (version prior to 156.0.8078.47) into visiting it. The crafted HTML triggers improper input validation in the Chromoting (Chrome Remote Desktop) component, allowing the attacker to execute arbitrary code, but only within the browser sandbox. No public exploit code is referenced, and successful exploitation requires user interaction (UI:R) to load the attacker's page.