Google Chrome CVE-2026-113139

Exploitation requires the victim to load attacker-controlled content that exercises the Autofill component, and the CVSS UI:R metric confirms user interaction is mandatory - the attack cannot succeed without a user visiting or interacting with a crafted HTML page. No authentication is required (PR:N). Impact is limited to reading memory within the renderer sandbox (S:U, no scope change); this is an information-disclosure primitive, not code execution or sandbox escape, so on its own it does not grant control of the host and would typically need to be chained with a separate sandbox-escape vulnerability for meaningful compromise. Affected builds are Chrome prior to 156.0.8078.47; updated versions are not exploitable.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) indicates remote, low-complexity, unauthenticated reach, but exploitation is gated on user interaction (UI:R) and the impact is confidentiality-only (C:H, I:N, A:N) with no scope change (S:U) - meaning the flaw yields a read of memory *inside* the renderer sandbox rather than code execution or sandbox escape. The EPSS score is low (0.22%, 11th percentile), consistent with an info-leak primitive that requires a crafted page and a victim visit rather than a wormable or server-side bug. There is no CISA KEV listing and no POC referenced in the supplied data, so this is 'no public exploit identified at time of analysis.' Signals are largely consistent: a Medium Chromium-rated bug, modest EPSS, no exploitation evidence. One caveat to verify: the description says 'potentially read memory inside the sandbox,' which is more bounded than a full C:H high-confidentiality rating would normally imply - the official C:H may slightly overstate the realistic disclosure scope. Memory-read bugs like this are typically chained with a separate sandbox-escape bug to be dangerous on their own.

An attacker hosts a malicious web page (or injects crafted HTML into a site the victim visits) that abuses the Autofill component to trigger memory corruption. When a user with a vulnerable Chrome build loads the page and interacts as required, the attacker reads out-of-bounds memory from inside the renderer sandbox, potentially leaking sensitive in-process data such as pointers or credential fragments. No public exploit code was identified in the provided data.