Google Chrome CVE-2026-113149

Exploitation requires a victim running Google Chrome prior to 156.0.8078.47 to load attacker-controlled HTML that exercises the FullScreen code path (per UI:R, user interaction such as visiting a page is mandatory - this is not zero-click). The principal limiting factor is sandbox containment: the description states code executes INSIDE the Chrome sandbox (S:U, scope unchanged), so standalone exploitation does not escape to the host OS and would require an additional sandbox-escape vulnerability to achieve meaningful post-exploitation impact. No authentication is required (PR:N), and default configurations are affected since no special feature toggle is named.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a remotely reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page. However, this nominal 'High' score is strongly tempered by the description's explicit qualifier that arbitrary code executes INSIDE the Chrome sandbox - Google itself rated the Chromium security severity as Medium. That gap is the decisive signal: a renderer-contained memory-corruption bug is not directly a full host compromise and typically must be chained with a separate sandbox-escape to achieve real-world impact, which the CVSS base score does not capture. No EPSS probability was provided, the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced, so there is no evidence of active exploitation or available exploit code at time of analysis. Net assessment: patch promptly as part of normal Chrome update hygiene, but this is a moderate-priority renderer bug rather than an actively-exploited emergency - the 8.8 CVSS overstates standalone impact relative to the Medium Chromium rating and sandbox containment.

An attacker hosts or compromises a web page containing malformed content that triggers the FullScreen memory-corruption flaw when a victim using a vulnerable Chrome build (prior to 156.0.8078.47) visits it. Because the vector is network-based with low complexity but requires user interaction (UI:R), the victim must simply browse to the page; successful exploitation yields code execution confined to the renderer sandbox, which would then need to be chained with a sandbox-escape to affect the host. No public exploit code is identified at time of analysis.