Google Chrome CVE-2026-113094

Exploitation requires the victim to load attacker-controlled HTML content in a vulnerable Google Chrome build earlier than 156.0.8078.47 (UI:R - the crafted page must be visited), triggering the memory-corruption flaw in the browser's API handling. Limiting factors: user interaction is mandatory (no drive-by without the victim navigating to or rendering attacker content), and the resulting code execution is confined to the renderer sandbox per the description - achieving host-level compromise would require an additional sandbox-escape not described in this CVE. No authentication is required (PR:N). Updating to 156.0.8078.47 or later remediates the issue.

The input CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (victim visits a crafted HTML page) and yields high confidentiality, integrity, and availability impact - consistent with a browser renderer memory-corruption bug. A critical nuance the raw 8.8 obscures: the description states code execution occurs 'inside the sandbox,' so this alone does not grant host compromise and would typically need to be chained with a separate sandbox-escape to achieve full RCE on the endpoint; Chromium itself rated the security severity only 'Medium.' No CISA KEV listing and no public exploit (POC) are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score and no SSVC decision data were supplied, so exploitation probability and automatability cannot be assessed from this input. Net: this is a legitimate, broadly-relevant browser vulnerability worth prompt patching given Chrome's ubiquity and the unauthenticated network vector, but there is no evidence of active or widespread exploitation, and the sandbox confinement plus required user interaction temper the real-world urgency relative to the 8.8 number.

An attacker hosts a malicious web page (or injects malicious content into a site/ad the victim loads) that triggers the API memory-corruption bug in the Chrome renderer. When the victim browses to the page, the attacker achieves arbitrary code execution confined to the browser sandbox, which would then need to be combined with a sandbox-escape to reach the host. No public proof-of-concept is identified in the provided data.