Google Chrome CVE-2026-113146

Exploitation requires the victim to open an attacker-controlled crafted HTML page in an unpatched Chrome build prior to 156.0.8078.47 (UI:R / user interaction required) - there is no server-side or passive network trigger. No authentication or special non-default configuration is needed (PR:N), so default installations are affected. The key LIMITING factor is that successful exploitation yields code execution only inside the renderer sandbox (Scope Unchanged); converting this into host-level compromise requires chaining with an independent sandbox-escape vulnerability. Required user interaction and sandbox containment meaningfully reduce real-world risk below what the 8.8 score implies.

Signals are mixed and should temper the raw score. The NVD CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R, indicating a remote, low-complexity, unauthenticated attack that only requires the victim to view a crafted HTML page - a classic drive-by browser exploitation profile. However, Google's own Chromium security severity rating is Medium, and critically the description states code execution occurs 'inside the sandbox,' meaning this flaw alone yields only renderer-process compromise, not host takeover, unless chained with a separate sandbox-escape bug. Scope is Unchanged (S:U), consistent with that containment. There is no EPSS score, no CISA KEV listing, and no indication of public exploit code in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' Memory-corruption renderer bugs in Chrome are routinely patched before weaponization and often require significant exploit-development effort. Net assessment: this is a patch-promptly browser vulnerability rather than an emergency - the high CVSS reflects the network/unauthenticated vector, but the Medium vendor rating, sandbox containment, and absence of exploitation signals (no KEV, no POC, no EPSS) argue against treating it as an active, widespread threat. The CVSS A:H/C:H/I:H impact metrics should be read in the context of the sandboxed renderer, not the full host.

An attacker hosts or compromises a web page containing malicious HTML/JavaScript that triggers the PerformanceAPIs memory-corruption bug. When a victim using an unpatched Chrome (prior to 156.0.8078.47) visits the page, the attacker gains arbitrary code execution within the renderer sandbox. No public exploit code is identified in the available data, and full host compromise would require chaining this with a separate sandbox-escape vulnerability.