Google Chrome CVE-2026-113141

Exploitation requires a victim using Google Chrome prior to 156.0.8078.47 to visit a web page containing attacker-crafted HTML/script that reaches the vulnerable Transactions Platform code path (UI:R - the user must open the malicious or compromised page). No authentication and no non-default configuration are needed (PR:N, AC:L), making default installations exploitable. The principal limiting factor is that resulting code execution is confined to the renderer sandbox per the description, so converting this into host-level compromise requires chaining an additional sandbox-escape vulnerability; the required user interaction further constrains purely automated mass exploitation.

Signals are largely consistent and point to a genuine priority within the browser threat model, though with an important caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H, score 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - the standard drive-by browser-exploitation pattern. Chromium rates the severity 'High'. The key nuance absent from the raw score is that the description explicitly scopes code execution to 'inside the sandbox' (consistent with S:U, scope unchanged): absent a separate sandbox-escape chain, impact is confined to the renderer process rather than the host OS, which materially lowers real-world severity versus a full RCE. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or available exploit code - exploitation status is therefore 'no public exploit identified at time of analysis'. Note that EPSS/KEV/POC being absent is not the same as confirmed-negative; it simply is not supplied here. UAF (CWE-416) bugs in Chrome are historically high-value and frequently weaponized once details emerge, so prompt patching is warranted despite the sandbox containment.

A remote attacker hosts or compromises a web page containing JavaScript/HTML that triggers the use-after-free in Chrome's Transactions Platform component; when a victim browses to it, the freed object is reclaimed and manipulated to achieve arbitrary code execution within the renderer sandbox. No public exploit code is identified at time of analysis, and user interaction (visiting the page) is required. Full host compromise would additionally require chaining a separate sandbox-escape vulnerability.