Google Chrome CVE-2026-113120

Exploitation requires the victim to load attacker-controlled web content in a vulnerable Chrome build (pre-156.0.8078.47) that exercises the Media component's media parsing/playback path - the crafted HTML page is the delivery mechanism and user interaction (UI:R) is mandatory, so there is no fully passive or server-side trigger. A key LIMITING factor is that, per the description, resulting code execution is confined to the renderer sandbox: converting this into host-level compromise requires chaining a separate sandbox-escape vulnerability. Additional limiters: only vulnerable desktop Chrome (and likely Chromium-derived browsers) before the fixed version are affected, and no authentication to the attacker's site is implied beyond the victim visiting it.

Signals are moderately aligned toward a real but not top-tier priority. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U) reflects Chrome's standard scoring for a remotely-reachable memory-safety issue requiring only that a user open a page, but it OVERSTATES real-world impact here: the description explicitly states code execution occurs 'inside the sandbox', meaning a full compromise still requires a separate sandbox-escape chain - yet the vector carries C:H/I:H/A:H and S:U, which does not credit that containment. This is why Google itself rates the Chromium security severity only 'Medium' despite the 8.8 NVD number - a notable CVSS-vs-vendor divergence worth flagging. Exploitation status is 'no public exploit identified at time of analysis': the input provides no KEV listing, no POC flag, and no EPSS score, so there is no evidence of active or probable near-term exploitation. Net: patch in the normal Chrome update cycle rather than emergency out-of-band; the inflated 8.8 is driven by the ubiquity/network-vector scoring convention, not by confirmed weaponization, and the sandbox limitation plus required user interaction meaningfully reduce practical risk.

An attacker hosts a crafted HTML page containing malformed media content and lures a victim running a pre-156.0.8078.47 Chrome build to visit it (phishing link or malvertising). When the page's media is parsed, improper input validation lets the attacker execute arbitrary code within the renderer sandbox; no public exploit code was identified in the provided data, and a further sandbox escape would be needed for host compromise.