Google Chrome CVE-2026-113072

Exploitation requires a victim using an affected Chrome desktop or ChromeOS build (prior to 156.0.8078.47) to load an attacker-controlled HTML page whose CSS triggers the memory-corruption condition in the CSS engine; this maps to the CVSS UI:R requirement. The single limiting factor is this user interaction - the victim must navigate to or render the malicious page (e.g., via a link, ad, iframe, or watering-hole site). No authentication, no special Chrome configuration, and no non-default feature are required: the CSS rendering path is exercised by default when any page is displayed. The practical constraint is simply getting the target to open the crafted content, after which exploitation is unauthenticated and low-complexity.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, score 9.6) indicates network-reachable, low-complexity, unauthenticated exploitation requiring only that a victim load a crafted HTML page, with a scope change reflecting sandbox escape and full confidentiality/integrity/availability impact. Google/Chromium rates the security severity Critical and the description explicitly states code execution OUTSIDE the sandbox, which is the most dangerous class of Chrome bug. Mitigating signals: no EPSS score was provided, CISA KEV status is not indicated (KEV=NO in available data), and no public proof-of-concept is referenced, so there is currently no public evidence of active exploitation or weaponization. The required user interaction (UI:R) modestly lowers real-world risk versus a fully drive-by zero-click flaw, but given Chrome's install base and the trivial 'visit a page' interaction, this should be patched urgently. Note the absence of EPSS/KEV/POC is a data gap, not evidence of safety - these absences cannot be used to downgrade priority for a Critical sandbox-escape in a browser.

An attacker hosts or compromises a web page containing malicious CSS that triggers the memory-corruption bug in Chrome's CSS engine when rendered. A victim running an unpatched Chrome (prior to 156.0.8078.47) simply visits the page, and the flaw is exploited to execute arbitrary code outside the browser sandbox, giving the attacker control of the user's machine. No public exploit code is identified at time of analysis, but the low attack complexity and single-click delivery make this highly attractive for drive-by and watering-hole campaigns.