Google Chrome CVE-2026-113155

Requires a victim using Chrome prior to 156.0.8078.47 to actively load attacker-controlled crafted HTML (CVSS UI:R - e.g. visiting a malicious or compromised web page); no authentication or privileges are needed (PR:N). The critical LIMITING factor is that successful exploitation yields code execution only INSIDE the Chrome renderer sandbox (S:U), not on the host - converting this to host-level compromise would require chaining a separate sandbox-escape vulnerability. The flaw is in the Glic component specifically; exploitation depends on reaching that code path through the rendered page, and the mandatory user interaction (navigation) reduces viability for fully automated, zero-click mass exploitation.

Signals are mixed and should be weighed carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 High) describes a network-reachable, low-complexity, unauthenticated memory-corruption bug requiring only user interaction (visiting a page), which on its face reads as high priority. However, the description explicitly states the attacker executes code 'inside the sandbox' and the scope is Unchanged (S:U) - this is a single renderer-level use-after-free, NOT a full sandbox escape or host compromise, which is why Google/Chromium rated it only Medium severity despite the 8.8 score. This is the key tension: CVSS treats in-sandbox code execution as C:H/I:H/A:H, but real-world impact is bounded by the Chrome sandbox and would require a second chained bug (sandbox escape) to achieve host-level RCE. No EPSS score was provided, there is no CISA KEV listing, and no public exploit (POC) was identified in the input, so there is no evidence of active or imminent exploitation. Net: patch promptly because Chrome is ubiquitous and UI:R browser bugs are routinely weaponized in exploit chains, but this is not a standalone critical priority - the headline 8.8 overstates the real-world impact given sandbox containment.

A remote attacker hosts or compromises a web page containing crafted HTML that triggers the use-after-free in Chrome's Glic component; a victim running a vulnerable Chrome build (prior to 156.0.8078.47) visits the page and the attacker gains arbitrary code execution confined to the renderer sandbox. No public exploit code was identified at time of analysis, and realistic full-host compromise would require chaining this with a separate sandbox-escape vulnerability.