Google Chrome CVE-2026-113140

Exploitation requires a victim running Chrome prior to 156.0.8078.47 to load attacker-controlled HTML/web content that exercises the ANGLE component (Chrome's OpenGL ES abstraction used for GPU-accelerated rendering); no authentication and no non-default configuration are needed. The primary limiting factors are: (1) mandatory user interaction (UI:R) - the victim must navigate to or render the malicious page; and (2) sandbox containment - successful exploitation yields arbitrary code execution only within the renderer sandbox, so full host compromise requires chaining an additional sandbox-escape vulnerability. These constraints meaningfully reduce realistic impact below what the 8.8 base score implies.

Signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) rates this high, reflecting remote, unauthenticated, low-complexity exploitation requiring only that a victim open a crafted HTML page. However, Google's own Chromium security severity is explicitly rated 'Low', and the description states code execution is confined 'inside the sandbox' - meaning the flaw alone does not achieve full host compromise and would need to be chained with a separate sandbox-escape to be fully weaponized. This is the key contrast: the 8.8 base score does not model the renderer-sandbox containment, so the CVSS severity overstates standalone real-world impact. No CISA KEV listing is present in the input, so this is not confirmed actively exploited; no POC is referenced; and no EPSS score was provided, so exploitation probability cannot be quantified from available data. Net: a patch-promptly item given Chrome's ubiquity and the ease of delivery, but not an emergency relative to its headline CVSS, because exploitation yields only sandboxed code execution and no public exploit is identified.

An attacker hosts or injects a malicious web page containing crafted content that drives ANGLE (Chrome's graphics abstraction layer) into a use-after-free condition. When a victim using a vulnerable Chrome build visits the page, the freed-then-reused object is manipulated to achieve arbitrary code execution within the renderer sandbox. No public exploit code is identified at time of analysis, and full system compromise would additionally require a sandbox escape.