Google Chrome CVE-2026-113135

Exploitation requires the victim to load attacker-controlled HTML in Chrome versions prior to 156.0.8078.47 that triggers the Picture-in-Picture (PiP) code path; the vulnerable PiP media feature must be reachable during page rendering. The key limiting factor is required user interaction (UI:R) - the target must actively navigate to or render the malicious page - and the fact that successful exploitation yields code execution only inside the renderer sandbox (S:U), so host compromise additionally requires a separate sandbox-escape vulnerability. No authentication is needed (PR:N) and no special victim-side configuration is indicated beyond running an unpatched Chrome build.

CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a remotely reachable, low-complexity flaw requiring no privileges but one user action (visiting a crafted page). Chromium itself rated the issue 'High', not Critical, and the description is explicit that code execution occurs 'inside the sandbox' with scope unchanged (S:U) - this is a renderer-side memory-corruption bug, NOT a confirmed sandbox escape, so standalone impact is contained to the sandboxed process unless chained with a separate escape. No EPSS score, SSVC decision data, KEV entry, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk signal rests entirely on the CVSS vector and Chrome's enormous deployment footprint. Net: a genuinely important browser patch given ubiquity and low attack complexity, but absent a chained sandbox escape and with no exploitation or POC signals supplied, it is high-priority-to-patch rather than confirmed emergency-grade. CVSS and description are consistent (network vector, user interaction via HTML page), so no metric conflict is present; the main missing signals are EPSS and SSVC, which could not be assessed from available data.

An attacker hosts or compromises a web page containing malicious content that abuses the Picture-in-Picture component, then lures a Chrome user (via link, ad, or redirect) to visit it. When the page renders, the crafted input triggers memory corruption in the PiP code, potentially allowing arbitrary code execution within the sandboxed renderer process. No public exploit code was identified in the provided data; practical weaponization would typically require chaining a separate sandbox-escape bug to affect the host.