Google Chrome CVE-2026-113131

Exploitation requires the victim to navigate a vulnerable Chrome build (prior to 156.0.8078.47) to an attacker-controlled HTML page that exercises the Bluetooth code path - user interaction (UI:R) to load the page is the primary limiting factor, though no authentication or non-default configuration is needed. The critical containment is that successful exploitation yields code execution only 'inside the sandbox' (Scope:Unchanged), so impact to the host OS, other origins, or user data outside the renderer requires a separate, chained sandbox-escape vulnerability not covered by this CVE.

This is a genuine patch-now issue for any Chrome fleet, though the raw CVSS 8.8 overstates the worst case somewhat. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) describes a remote, low-complexity, unauthenticated attack requiring only that a victim load a crafted HTML page - a realistic bar for browsers. However, the description explicitly scopes code execution to 'inside the sandbox,' and the Scope:Unchanged (S:U) metric is consistent with that: this flaw alone does not escape the renderer sandbox, so full host compromise requires chaining a separate sandbox-escape bug. That is why Google's own Chromium severity is rated Medium even though the CVSS base score is High - the two signals are not contradictory but measure different things (CVSS impact-within-reach vs. vendor's holistic triage). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or available exploit code at this time. Net: real priority because of ubiquity and ease of trigger, but the sandbox containment and absence of exploitation signals place it below in-the-wild zero-days.

An attacker hosts or compromises a web page containing crafted content that abuses Chrome's Bluetooth implementation; when a victim with a vulnerable Chrome version visits it, the memory-corruption bug is triggered and attacker-controlled code runs inside the renderer sandbox. No public exploit code was identified at time of analysis, and because the attack is network-delivered with low complexity, a drive-by or malvertising delivery is plausible, but useful host compromise would require pairing this with a sandbox escape.