Google Chrome CVE-2026-113066

Exploitation requires the victim to use an affected Chrome desktop build (prior to 156.0.8078.47) and to load attacker-controlled HTML containing a crafted/malformed font that reaches the vulnerable font-parsing code path - this is the default rendering behavior, so no special configuration is needed, but the UI:R requirement means the user must actively navigate to or be lured to the malicious page. The primary limiting factors are the mandatory user interaction and that the disclosure is confined to memory inside the renderer sandbox (no integrity, availability, or sandbox-escape impact), reducing realistic severity to an information leak rather than code execution.

Signals are largely consistent and point to a moderate, non-urgent issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (visiting a crafted page) and yields high confidentiality impact but no integrity or availability impact - matching the description of an attacker reading memory inside the renderer sandbox. Crucially, Google/Chromium rated the security severity 'Low,' which tempers the 6.5 (Medium) base score: the leak is confined inside the sandbox rather than a sandbox escape or RCE. EPSS is low at 0.22% (12th percentile), there is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation. The one tension worth noting: CVSS confidentiality is scored C:H while the vendor's own severity is Low and the impact is an in-sandbox memory read, so the real-world information-disclosure value is likely lower than C:H alone implies - verify the sensitivity of readable memory before prioritizing. Overall this is a routine browser patch-cycle item, not an emergency.

An attacker hosts or compromises a web page containing a malformed font that triggers the memory-corruption bug in Chrome's font handling when a victim browses to it. The out-of-bounds read discloses adjacent renderer-process memory to the attacker-controlled page, potentially leaking data from within the sandbox. No public exploit code has been identified, and successful attack requires the victim to load the crafted page.