Google Chrome CVE-2026-113073

Exploitation requires a victim to open an attacker-controlled crafted HTML page in a Chrome version prior to 156.0.8078.47 (UI:R - user interaction is mandatory, which is the primary limiting factor; no authentication is required per PR:N). The resulting arbitrary code execution is explicitly confined 'inside the sandbox,' so a full host compromise additionally requires chaining a separate sandbox-escape vulnerability - the sandbox is the key mitigating boundary here. No non-default configuration is needed; any default Chrome install on the affected versions that renders the malicious page is exposed.

The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 HIGH) describes a remotely-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page - a trivially-satisfied condition for a web browser. However, two signals temper this: (1) Google's own Chromium severity rating is MEDIUM, conflicting with the HIGH CVSS, and (2) the description explicitly states code execution occurs 'inside the sandbox,' meaning this is a renderer/sandboxed-execution primitive rather than a full host compromise - a sandbox escape would be required to translate it into attacker control of the machine, which the CVSS C:H/I:H/A:H does not capture as scope-unchanged. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or public exploit code at this time: no public exploit identified at time of analysis. Net assessment: patch promptly because of the ubiquitous footprint and trivial reachability, but this is not an emergency-grade KEV-driven issue, and the sandbox confinement plus the vendor's MEDIUM rating argue against treating it as an immediate full-RCE threat. Verify the HIGH-vs-MEDIUM severity discrepancy against Google's advisory before prioritizing above other Chrome fixes.

An attacker hosts a malicious web page (or injects malicious content into a compromised/ad-served page) that triggers the use-after-free in Chrome's Browser component when a victim visits it. Exploiting the freed-object reuse yields arbitrary code execution confined to the Chrome sandbox; the attacker would need to chain a separate sandbox-escape bug to compromise the underlying host. No public exploit code was identified in the provided data.