Google Chrome CVE-2026-113137

Exploitation requires the victim to open a crafted HTML page in a vulnerable Google Chrome build prior to 156.0.8078.47 (AV:N/PR:N confirm remote, unauthenticated reach), and the flaw is in the Extensions component. The key limiting factor is required user interaction (UI:R): the victim must actively load the attacker-controlled page, so this is not a zero-click flaw. The stated impact is contained to reading memory inside the browser sandbox, which limits realistic severity to information disclosure rather than code execution or sandbox escape. Users on 156.0.8078.47 or later are not affected.

Signals are mixed but converge on moderate, not critical, priority. The input CVSS base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but this is Google's/NVD's generic high-severity Chrome template and directly conflicts with the description, which states only that an attacker could 'potentially read memory inside the sandbox' - a read-only, sandbox-contained information-disclosure outcome, not full compromise. Chromium itself rated this 'Medium'. EPSS is 0.18% (8th percentile), i.e. low predicted exploitation probability, which is consistent with the absence of a KEV listing and no identified public exploit. No SSVC decision data was provided. Net: this is a high-nominal-CVSS but lower-real-risk issue - a sandbox-level memory read requiring user interaction, with no evidence of active or imminent exploitation. Explicit conflict to verify with vendor: the CVSS vector claims C:H/I:H/A:H and scope-unchanged full impact, whereas the description implies only limited confidentiality (reading memory within the renderer sandbox) and no stated integrity/availability effect.

An attacker hosts a crafted HTML page (or injects crafted content via a malicious ad/iframe) that exercises the Extensions memory-corruption flaw when a victim running an unpatched Chrome (prior to 156.0.8078.47) visits it. Exploitation requires the user to load the page (UI:R) and could let the attacker read memory contents within the browser sandbox, potentially leaking sensitive in-process data. No public exploit identified at time of analysis.