Google Chrome CVE-2026-113067

Exploitation requires the victim to use the Chromoting (Chrome Remote Desktop) functionality path in Chrome and to open or render a crafted HTML page in a vulnerable build prior to 156.0.8078.47 - user interaction (navigation to the attacker's page) is mandatory per UI:R, which is the primary limiting factor. No authentication or elevated privileges are needed (PR:N). The critical containing factor is that the resulting arbitrary code execution occurs strictly inside the browser sandbox, so without a chained sandbox-escape vulnerability the attacker does not gain code execution on the host OS; this containment is why Chromium rated the issue 'Low' despite the network attack vector.

Signals are genuinely conflicting and must be weighed carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) presents this as a network-reachable, low-complexity, unauthenticated remote code execution needing only that a victim open a crafted HTML page. However, the description explicitly states the arbitrary code executes INSIDE the sandbox, and Google/Chromium rated the security severity as Low - a direct contradiction of the 8.8 High score. Sandbox-contained execution means an attacker gains code execution only within a restricted renderer/host process and still requires a separate sandbox-escape to achieve real system compromise; the 8.8 score appears to overstate real-world impact for that reason. On exploitation likelihood: this is NOT in CISA KEV and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score, POC flag, or SSVC decision data was provided, so automatability and exploitation-maturity signals are unknown. Net assessment: real priority is MODERATE despite the High CVSS - the ubiquity of Chrome and the user-interaction-only barrier argue for prompt patching, but the sandbox containment and absence of known exploitation argue against emergency treatment. Verify the effective impact with Google, since CVSS High and vendor 'Low' severity disagree.

A remote attacker hosts or compromises a web page containing malicious content that triggers the use-after-free in Chrome's Chromoting (Chrome Remote Desktop) component; when a victim running a vulnerable Chrome build (prior to 156.0.8078.47) visits the page, the freed-then-reused memory is manipulated to execute attacker-controlled code within the browser sandbox. Exploitation requires user interaction (UI:R) - the victim must navigate to the page - but no authentication or special privileges. No public proof-of-concept or exploit code is referenced in the provided data, and resulting code execution is confined to the sandbox absent a separate escape.