Google Chrome CVE-2026-113090

Exploitation requires user interaction (UI:R): the victim must load or navigate to a crafted HTML page under attacker control, so this is not a wormable zero-click flaw. No authentication or special privileges are needed (PR:N). The key limiting factor is sandbox containment - per the vendor description and S:U, code execution occurs inside the Chrome renderer sandbox, meaning a separate sandbox-escape vulnerability would be required to compromise the host OS or access data outside the browser. Exploitation targets Chrome versions prior to 156.0.8078.47; patched/auto-updated installs are not affected.

Multiple signals must be weighed carefully here, and they conflict. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H → 8.8 High) treats this as a high-severity remote code execution bug: network-reachable, low complexity, no privileges required, triggered simply by getting a victim to load a crafted HTML page. However, Google's own Chromium security team rated this only 'Medium', and the code execution is explicitly confined to inside the Chrome renderer sandbox (reflected in S:U, scope unchanged). That sandbox containment is the single most important risk discriminator: without a chained sandbox-escape bug, the attacker does not gain control of the host OS or user data outside the renderer, which is why Google's internal rating is lower than the NVD-style 8.8. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization - this is not currently a confirmed in-the-wild priority. Net assessment: patch on the normal browser-update cadence (Chrome auto-updates), treat as a meaningful but not emergency fix. The CVSS 8.8 overstates real-world impact because it does not credit sandbox containment; conversely, do not dismiss it, as memory-corruption renderer bugs are the classic first link in a full exploit chain.

A remote attacker hosts a malicious web page (or injects crafted content into a page the victim visits) that triggers the memory-corruption flaw in Chrome's Interstitials component. When the victim's browser renders the crafted HTML, the attacker achieves arbitrary code execution within the renderer sandbox. No public exploit code was identified at the time of analysis, and additional sandbox-escape chaining would be required to impact the underlying host.