Google Chrome CVE-2026-113109

Exploitation requires the victim to actively navigate their Chrome browser to attacker-controlled crafted HTML content (UI:R) on a version prior to 156.0.8078.47; no authentication or special configuration is needed. The key limiting factor is that resulting code execution is confined to the renderer sandbox per the description, so real-world host compromise additionally requires a separate sandbox-escape vulnerability. User interaction (opening or visiting the page) is mandatory, which rules out fully zero-click drive-by exploitation.

All signals point to a credible but second-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a remote, low-complexity, unauthenticated flaw that only requires a victim to load a crafted HTML page, which is realistic for a browser. However, two mitigating facts temper the raw score: the description explicitly scopes code execution to INSIDE the sandbox, so a second sandbox-escape bug would be needed for full host compromise, and Google rated the Chromium security severity only 'Medium', conflicting with the 8.8 'High' CVSS. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation; the SSVC exploitation status is effectively 'none' at this time. Net: patch promptly given Chrome's ubiquity and the browser attack surface, but this is not a confirmed in-the-wild emergency. Note the CVSS-versus-Chromium-severity discrepancy and the sandbox-confinement caveat when triaging.

An attacker hosts or compromises a web page containing crafted HTML that triggers the memory-corruption bug in Chrome's API when a victim running a vulnerable version (prior to 156.0.8078.47) navigates to it. Successful exploitation yields arbitrary code execution confined to the renderer sandbox, which would typically need to be chained with a separate sandbox-escape bug for full compromise. No public exploit code was identified at the time of analysis.