Google Chrome CVE-2026-113126

Exploitation requires a victim using a vulnerable Google Chrome desktop build (any version prior to 156.0.8078.47) to actively load an attacker-controlled HTML page that triggers the memory-corruption flaw in the PolicyContainer component - the CVSS UI:R metric confirms this user-interaction requirement, which is the primary limiting factor. No authentication or special Chrome configuration is indicated (PR:N, default rendering path), and no non-default feature toggle is named in the description. The practical limiter is that the attacker must drive the target to malicious web content and, per the description, the bug only 'potentially' achieves code execution outside the sandbox, implying exploitation may not be fully reliable; the Chromium 'Medium' internal severity reinforces that weaponization is non-trivial.

Signals are mixed and should be weighed carefully. The NVD CVSS 3.1 base score is 9.6 (Critical) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, indicating a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page, with a scope change reflecting the claimed sandbox escape. However, Google/Chromium explicitly rated this issue 'Medium' severity, a notable divergence from the 9.6 NVD score - this gap is common for Chromium bugs where the practical exploitability (e.g., requiring chaining or being hard to weaponize) is lower than the theoretical impact, and it should temper prioritization rather than being treated as a pure Critical. No EPSS score, SSVC decision data, KEV listing, or public POC is present in the provided intelligence, so exploitation probability cannot be quantified from the input. There is no public exploit identified at time of analysis and no evidence of active exploitation (not in CISA KEV). Net assessment: a genuinely serious client-side RCE/sandbox-escape class issue in an ubiquitous product that warrants prompt patching, but the Chromium 'Medium' rating and absence of exploitation signals suggest this is not a fire-drill emergency compared to a KEV-listed browser 0-day. The CVSS-vs-Chromium-severity conflict should be flagged to stakeholders.

An attacker hosts or compromises a web page containing specially crafted HTML that triggers memory corruption in Chrome's PolicyContainer component when rendered. A victim running a vulnerable Chrome build (prior to 156.0.8078.47) visits the page, and the memory corruption is leveraged to execute arbitrary code outside the browser sandbox. No public exploit code was identified in the provided intelligence, so real-world weaponization difficulty is unknown.