Google Chrome CVE-2026-113089

Exploitation requires the victim to open an attacker-controlled HTML page in Chrome and interact with the PrintPreview feature (per CVSS UI:R), which triggers the improper input validation leading to code execution outside the sandbox. Limiting factors: the attack is not zero-click - it depends on the user invoking print preview on the malicious page - and affects Chrome versions prior to 156.0.8078.47, so patched installs are not exploitable. A full host compromise realistically depends on the sandbox-escape primitive being reliable against the deployed platform; the input does not confirm whether additional chaining is needed.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) yields a 9.6 Critical score driven by network reach, low complexity, no privileges, and a changed scope reflecting the sandbox escape - a crafted HTML page that validates improperly in PrintPreview can run code outside the renderer sandbox, which is why scope is Changed. This signal conflicts sharply with Google's own 'Chromium security severity: Medium' rating, indicating that while the technical impact is severe, Google assesses practical exploitability or reachability as moderate (print-preview sandbox escapes typically require chaining and user interaction). The one mitigating CVSS factor is UI:R: the victim must actually invoke/interact with print preview on an attacker-controlled page, so this is not a drive-by zero-click. No EPSS score, no KEV listing, and no POC are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; treat exploitation probability as currently unquantified. Net: this is a genuine high-priority browser patch because of Chrome's ubiquity and the sandbox-escape potential, but the CVSS 9.6 overstates real-world urgency relative to Google's Medium rating and the absence of exploitation signals - prioritize via normal rapid browser-update cycles rather than emergency response. Note the vendor-severity vs. CVSS discrepancy should be resolved against Google's advisory before escalation.

An attacker hosts a crafted HTML page and lures a user to open it and trigger Chrome's print preview, where improper input validation in PrintPreview is abused to break out of the renderer sandbox. If successful, the attacker executes arbitrary code in a higher-privileged browser process, moving beyond the sandbox toward the host. No public exploit code is identified at time of analysis, and user interaction (invoking print preview) is required per the CVSS UI:R metric.