Google Chrome CVE-2026-113076

Exploitation requires the victim to use Google Chrome on Android at a version prior to 156.0.8078.47 and to load attacker-controlled HTML (UI:R - the user must navigate to or render the crafted page); it is not triggered automatically without that page load. The resulting arbitrary code execution is explicitly confined to the Chrome sandbox, so it does not by itself yield full device/OS compromise - a separate sandbox escape would be needed for that, which is the primary limiting factor on real-world impact. No special non-default configuration or authentication is required beyond visiting the page.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that the victim load a crafted HTML page - the classic drive-by profile for a browser bug. However, two signals pull the real-world priority down from what 8.8 suggests. First, Google/Chromium assigned this a 'Medium' security severity, which conflicts with the HIGH CVSS score; this gap is typical for Chrome use-after-free bugs whose code execution is confined to the renderer sandbox, as the description explicitly states ('execute arbitrary code inside the sandbox'). Full device compromise would additionally require a separate sandbox-escape chain, which this CVE does not provide. Second, there is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data - so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a genuinely patch-worthy memory-corruption bug in an ubiquitous product, but absent a chained sandbox escape and with no exploitation signals, it is standard-cadence browser-patch priority rather than an emergency. Note the conflict to verify: the vendor 'Medium' rating versus the HIGH 8.8 CVSS - the vendor rating better reflects the sandbox-contained impact.

An attacker hosts or compromises a web page containing malicious HTML/JS that triggers the use-after-free in Chrome's Toolbar component on Android. A victim using a vulnerable Chrome build (prior to 156.0.8078.47) simply visits the page, and the freed-object reuse is leveraged to execute arbitrary code within the renderer sandbox. No public PoC is identified at time of analysis, and the executed code remains sandbox-confined unless combined with a separate escape.