Google Chrome CVE-2026-113068

Exploitation requires the victim to load attacker-controlled content in Chrome - specifically visiting or rendering a crafted HTML page (UI:R) - triggering the use-after-free in the Input component; no authentication or elevated privileges are needed (PR:N). The key limiting factor is sandbox containment: arbitrary code runs INSIDE the Chrome renderer sandbox, so a separate sandbox-escape is required to reach the underlying OS, meaningfully constraining real-world impact. Only Chrome builds prior to 156.0.8078.47 across desktop and ChromeOS are affected; updated installations are not exploitable.

This is a genuine high-priority patch target, though the real-world risk is more nuanced than the 8.8 CVSS alone suggests. The CVSS vector (AV:N/AC:L/PR:N/UI:R) describes a remotely reachable, low-complexity, unauthenticated memory-corruption bug requiring only that a victim load a crafted HTML page - a realistic condition for a web browser. The critical qualifier straight from the description is that code execution occurs INSIDE the Chrome sandbox (consistent with S:U, Scope Unchanged); without a chained sandbox-escape this does not by itself yield full host compromise, which tempers the practical impact versus a classic unsandboxed RCE. Signals are otherwise thin: there is no CISA KEV listing and no public POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' Note the apparent tension that Google rates the Chromium severity only 'Medium' while the assigned CVSS base is 8.8/High - this reflects Google's internal rating that factors in the sandbox containment, whereas CVSS scores the renderer-level impact; both are internally consistent once sandbox scope is understood. EPSS data was not provided and cannot be commented on. Bottom line: patch promptly given Chrome's ubiquity and the browser-UAF exploitation track record, but treat this as sandboxed-renderer RCE rather than confirmed in-the-wild full-system compromise.

An attacker hosts a malicious web page (or injects malicious content into an ad/iframe on a compromised site) that triggers the use-after-free in Chrome's Input component when a victim browses to it. Exploiting the freed object lets the attacker execute arbitrary code within the renderer sandbox, typically as a first stage to be chained with a separate sandbox-escape for full compromise. No public exploit code was identified in the provided data, so this remains a theoretical-but-realistic scenario for a browser UAF.