Google Chrome CVE-2026-113105

Exploitation requires the victim to load a crafted HTML page in a vulnerable Chrome build (any version prior to 156.0.8078.47) - reflected by UI:R in the CVSS vector - so it is a one-click/drive-by vector rather than a zero-interaction network attack. The flaw resides in the Extensions component and executes attacker code only within the renderer sandbox (Scope:Unchanged); the key LIMITING factor is that impact is confined to the browser sandbox, so reaching the underlying OS or host data requires chaining a separate sandbox-escape vulnerability. No authentication is needed (PR:N), and default Chrome configurations are affected; up-to-date browsers (>=156.0.8078.47) are not vulnerable.

The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating remote, low-complexity, unauthenticated exploitation that nonetheless requires user interaction (the victim must open a crafted HTML page). A critical nuance that tempers the raw score: the description explicitly states code execution occurs 'inside the sandbox' and the scope is Unchanged (S:U) - this is a renderer-level use-after-free, NOT a full host compromise, which is why Google/Chromium rated it only 'Medium' severity internally despite the 8.8 CVSS. These two signals conflict and should be reconciled: the 8.8 reflects worst-case renderer-process impact, while the vendor's Medium rating reflects that a separate sandbox-escape bug would be needed to reach the host. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit code identified at time of analysis, so there is no evidence of active or imminent exploitation. Net assessment: a legitimate patch-now item for any Chrome fleet because of ubiquity and the one-click delivery vector, but not an emergency relative to a sandbox-escaping or actively-exploited Chrome bug - treat as part of normal expedited browser patching rather than incident-level response.

An attacker hosts or compromises a web page containing malicious JavaScript/HTML that abuses the Extensions component to trigger a use-after-free, then lures a victim (via phishing link, malvertising, or compromised site) to visit it. When the page loads, the dangling pointer is reclaimed with attacker-controlled data, yielding arbitrary code execution confined to the Chrome renderer sandbox. No public proof-of-concept or exploit code was identified in the provided data, and escaping the sandbox to reach the host would require chaining a separate vulnerability.