Google Chrome CVE-2026-113156

Exploitation requires a victim running Google Chrome on Android before version 156.0.8078.47 to actively open or load an attacker-controlled crafted HTML page (UI:R), which triggers the use-after-free in the Messages component. No authentication or prior privileges are needed (PR:N). The key limiting factor is that resulting code execution is confined to the renderer sandbox (S:U, vendor 'Low' severity) - absent a separate sandbox-escape vulnerability, the attacker does not gain control of the underlying Android device or data outside the renderer. Required user interaction and the availability of the vendor patch further reduce realistic exposure.

Signals are mixed and require careful reading. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a remotely reachable, low-complexity flaw needing only that a victim open a crafted HTML page, which on paper is high-priority. However, the Chromium team assigned this a security severity of 'Low', and the description explicitly states code execution is confined 'inside the sandbox' with no scope change (S:U) - meaning no sandbox escape or host compromise is claimed. This is a direct conflict: the CVSS C:H/I:H/A:H rating treats renderer-process compromise as full high impact, while the vendor's 'Low' rating and the sandbox-containment language indicate real-world impact is constrained to the renderer process and typically requires chaining with a separate sandbox-escape bug to become dangerous. No EPSS score, CISA KEV listing, SSVC decision, or POC indicator was provided in the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: patch promptly as part of normal Chrome update hygiene, but this is more of a high-CVSS-but-moderate-real-risk issue than an emergency - a sandboxed, user-interaction-dependent UAF with a vendor 'Low' rating and no exploitation signals.

A remote attacker hosts or compromises a web page containing specially crafted content that triggers the use-after-free in the Messages component when a victim running a vulnerable Chrome on Android (prior to 156.0.8078.47) visits it. Successful exploitation yields arbitrary code execution confined to the renderer sandbox, not the host device. No public exploit code was identified at time of analysis.