Google Chrome CVE-2026-113078

Exploitation requires the victim to load attacker-controlled content in Chrome - the CVSS UI:R and the description's 'crafted HTML page' mean a user must visit a malicious or compromised web page; there is no click-beyond-navigation or authentication requirement (PR:N). The flaw resides in the Compositing component and affects default configurations of Chrome versions prior to 156.0.8078.47, so no special feature toggle is needed. The primary LIMITING factor is the required user interaction (navigating to the page) and the fact that the outcome is described as 'potentially' executing code outside the sandbox, implying exploitation may not be fully reliable; patched builds (156.0.8078.47+) are not affected.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6 Critical) describes a highly dangerous condition: a network-reachable, low-complexity, unauthenticated sandbox escape with full confidentiality, integrity and availability impact, requiring only that a victim load a page. There is a notable CONFLICT in the data: the vendor (Chromium) rated this 'Medium' severity, while the CVSS base score is 9.6 Critical - this gap likely reflects Chromium's internal severity methodology (which weighs exploitability and real-world reachability of the compositing bug) versus the mechanical CVSS scope-change calculation; defenders should not treat the 9.6 as fully vendor-endorsed. No EPSS score, no CISA KEV listing, and no public exploit (POC) were provided, so there is no evidence of active or imminent exploitation. Given the ubiquity of Chrome, the correct posture is prompt patch deployment on severity-and-reach grounds, but this is not currently a 'drop everything' actively-exploited emergency. In short: high theoretical severity and enormous attack surface, but no exploitation signal - prioritize patching broadly without assuming in-the-wild use.

An attacker hosts or compromises a web page containing malicious HTML that triggers the improper input validation flaw in Chrome's Compositing component. A victim running an unpatched Chrome (prior to 156.0.8078.47) simply visits the page, and the attacker potentially achieves arbitrary code execution outside the browser sandbox on the victim's host. No public exploit code was identified at the time of analysis.