Google Chrome (Android) CVE-2026-113083

Exploitation requires the victim to load attacker-controlled content in Google Chrome for Android at a version prior to 156.0.8078.47 - specifically a crafted HTML page that reaches the 'Actor' component, mapping to the CVSS UI:R requirement (victim must open/render the page). No authentication or special privileges are needed (PR:N). The key limiting factor is that successful exploitation yields code execution only INSIDE the renderer sandbox; achieving host-level compromise additionally requires a distinct sandbox-escape vulnerability not covered by this CVE. Exploitation is further limited to the Android platform and to pre-patch versions; updated browsers are not affected.

The input CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) signals a high-severity remote code execution reachable by a network attacker with low complexity, no privileges, and only user interaction (visiting a page). However, this headline score conflicts sharply with two other signals that lower real-world priority: (1) Google/Chromium explicitly rates this 'Low' severity, and (2) the description states code execution occurs 'inside the sandbox' - meaning a successful exploit is confined to the renderer process and would require a separate sandbox-escape chain to achieve meaningful host compromise. The CVSS vector does not model this containment (S:U, and C/I/A:H reflect full renderer compromise), which is why the numeric score overstates the standalone impact. There is no EPSS score, no CISA KEV listing, and no public POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' SSVC framing: exploitation=none observed, automatable=no (requires victim to load a crafted page), technical impact=partial given sandbox confinement. Net assessment: patch promptly because the product is ubiquitous and a vendor fix exists, but this is a lower real-world priority than the 8.8 implies - the sandbox boundary and vendor 'Low' rating indicate it is not independently weaponizable without additional bugs. Note the explicit conflict: CVSS 8.8 'High' versus Chromium 'Low' severity and sandboxed impact - treat the vendor rating as the better guide to standalone risk.

An attacker hosts or injects a crafted HTML page (e.g., via a malicious site, ad, or compromised page) and lures an Android Chrome user to visit it. Loading the page triggers the memory-corruption flaw in the 'Actor' component, letting the attacker run arbitrary code within the renderer sandbox. No public exploit code is known, and meaningful host compromise would require chaining this with a separate sandbox escape.