Google Chrome CVE-2026-113129

Exploitation requires the victim to open a crafted HTML page in a vulnerable Chrome build prior to 156.0.8078.47 (UI:R), and the flaw resides specifically in the Extensions subsystem's access-control handling, so an exploit must drive that extension/renderer context to disclose data. No authentication is required (PR:N) and the attack is remote (AV:N) with low complexity (AC:L). The principal limiting factor is the mandatory user interaction - there is no drive-by/zero-click path; the attacker must get the target to load malicious content. Impact is confined to information disclosure (no integrity or availability effect), further bounding realistic risk.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity, unauthenticated issue whose only real barrier is required user interaction (UI:R) - the victim must load attacker-controlled content. Impact is confidentiality-only (C:H/I:N/A:N), consistent with an information-leak primitive rather than code execution. No EPSS score was provided, and there is no CISA KEV listing or POC indicator in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' Chromium itself rated this Medium severity, and the description hedges with 'potentially leak sensitive information,' which argues against the C:H in the supplied vector - the practical confidentiality impact may be partial/conditional rather than full, so the real-world priority is moderate, not critical. The dominant risk driver is prevalence (Chrome is effectively everywhere), not exploitability. Conflict to verify: the supplied vector asserts C:H while the vendor rating (Medium) and the tentative language ('potentially') suggest a lower confidentiality impact - verify exact leaked data scope with the Chrome advisory. Net: patch on normal browser-update cadence; this is a widely-exposed but interaction-gated, confidentiality-only flaw, not an emergency.

An attacker hosts or injects a crafted HTML page and lures a victim running a vulnerable Chrome build to open it (UI:R). The page abuses improper access control in the Extensions subsystem to read sensitive information the renderer should not expose cross-context, exfiltrating it to the attacker. No public exploit code was identified in the provided data.