Google Chrome CVE-2026-113130

Exploitation requires the victim to visit an attacker-controlled crafted HTML page in a vulnerable Chrome desktop build prior to 156.0.8078.47 (UI:R, confirmed by CVSS vector and description). No authentication is required (PR:N). The critical limiting factor is that resulting code execution is confined to the renderer sandbox per the description - the attacker does NOT gain host-level execution without chaining an additional sandbox-escape vulnerability, which substantially reduces real-world impact. Standard Chrome auto-update further narrows the exposure window.

Signals conflict sharply and must be weighed together. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) treats this as a near-worst-case browser RCE, but Google's own Chromium security team rated it 'Low' - the decisive reason being that the description explicitly states code execution occurs 'inside the sandbox,' not a full sandbox escape or host compromise. A contained renderer-process compromise is materially less dangerous than the 8.8 score implies, which is why the vendor severity and the CVSS score diverge; the C:H/I:H/A:H impact metrics in the input appear not to account for the sandbox containment. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. Exploitation is further gated by required user interaction (UI:R) - the victim must be lured to a crafted page. Net assessment: patch in the normal Chrome update cycle; this is a genuine but lower-urgency memory-corruption bug, not a drop-everything emergency, and the raw 8.8 overstates real-world priority given the sandbox limitation and absence of exploitation signals.

An attacker hosts a malicious web page containing JavaScript/HTML crafted to trigger the use-after-free in the Actor component, then lures a victim running a vulnerable Chrome build (before 156.0.8078.47) to visit it. When the page loads, the freed object is reused, giving the attacker arbitrary code execution within the renderer sandbox. No public exploit code was identified, and a separate sandbox-escape bug would be required to reach the underlying host.