Google Chrome CVE-2026-113080

Exploitation requires the victim to use an affected Chrome build (prior to 156.0.8078.47) and to navigate to attacker-controlled content - the crafted HTML page that triggers the use-after-free in the WebAppInstalls component (UI:R). No authentication or special privileges are needed (PR:N), and default configurations are affected since WebAppInstalls is a built-in Chrome capability. The principal limiting factors are: (1) mandatory user interaction (the victim must open the malicious page), and (2) sandbox containment - the resulting arbitrary code execution is explicitly confined to the renderer sandbox, so full host compromise additionally requires a separate sandbox-escape vulnerability not covered by this CVE.

Signals conflict sharply here. The NVD CVSS 3.1 vector (8.8, AV:N/AC:L/PR:N/UI:R/C:H/I:H/A:H) scores this as High, implying remote code execution with low complexity and no privileges - but the description explicitly scopes code execution to 'inside the sandbox,' and Google/Chromium rated the security severity as Low. These two facts are the key tension: an 8.8 raw score overstates real-world impact because a renderer-sandbox-contained UAF does not by itself yield host compromise; an attacker would additionally need a separate sandbox-escape bug to reach the underlying OS. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of exploitation probability or active use - this appears to be no public exploit identified at time of analysis. The UI:R requirement (victim must open a crafted page) further lowers practical risk versus a drive-by with zero interaction. Net assessment: patch on the normal Chrome update cadence; this is a genuine memory-corruption bug in a ubiquitous product but is NOT a drop-everything emergency given sandbox containment, vendor's Low rating, and absence of exploitation signals. Note the CVSS-vs-vendor-severity divergence should be reconciled against Google's advisory rather than treating 8.8 as the operative priority.

An attacker hosts or compromises a web page containing crafted HTML/JavaScript that triggers the use-after-free in Chrome's WebAppInstalls component; a victim running a vulnerable version (prior to 156.0.8078.47) visits the page and the freed object is reused to achieve arbitrary code execution within the renderer sandbox. No authentication is required (PR:N) but user interaction is (UI:R), and the gained code execution remains confined to the sandbox absent a chained escape. No public exploit code was identified in the provided data.