Google Chrome CVE-2026-113138

Exploitation requires a victim using Google Chrome prior to 156.0.8078.47 to load attacker-controlled HTML content, triggering the memory-corruption flaw specifically in the WebAppInstalls component (associated with installing/managing web apps/PWAs). Limiting factors: the CVSS vector specifies UI:R, so the attack is not drive-by-automatic - the user must visit or render the malicious page; PR:N means no authentication is needed. The description's phrase 'potentially execute arbitrary code outside the sandbox' indicates that reliable host code execution likely depends on chaining with a separate sandbox-escape bug rather than being guaranteed by this flaw alone, which is consistent with the vendor's Medium severity rating.

Signals conflict and that conflict is the headline. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) yields 9.6 Critical: network-reachable, low-complexity, no privileges, with a scope change reflecting the escape 'outside the sandbox' and full confidentiality/integrity/availability loss. Yet the vendor itself (Chromium) rates the issue 'Medium', and the description hedges with 'potentially execute arbitrary code outside the sandbox', which for Chrome typically means a single memory-corruption primitive that in practice must be chained with a separate sandbox-escape bug to achieve host code execution - explaining the gap between the 9.6 score and the vendor's Medium rating. No EPSS score, KEV listing, or public POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: patch promptly given Chrome's ubiquity and the trivial delivery (one crafted web page), but treat the 9.6 as the theoretical worst case - the realistic standalone impact is closer to the vendor's Medium pending independent confirmation that code execution is achievable without chaining.

An attacker hosts a crafted HTML page (or compromises an ad/iframe) that triggers the memory-corruption flaw in Chrome's WebAppInstalls component when a victim running a version prior to 156.0.8078.47 visits it. Because UI:R is required, the victim must navigate to or load the malicious content; successful exploitation could corrupt memory to run attacker code outside the renderer sandbox, though standalone arbitrary-code execution likely requires chaining with a separate escape. No public exploit code was identified in the provided data.