Google Chrome CVE-2026-113158

Exploitation requires the victim to load attacker-controlled HTML in Chrome (UI:R) that exercises the vulnerable Streaming code path, triggering the use-after-free; no authentication or pre-existing privileges are needed (PR:N). Key LIMITING factors: (1) mandatory user interaction - the target must navigate to or render the malicious page, so drive-by delivery via ads/iframes or social engineering is needed; (2) successful code execution is confined to the renderer sandbox, so a separate sandbox-escape vulnerability must be chained to compromise the host OS; (3) only Chrome versions prior to 156.0.8078.47 are affected - patched/auto-updated installs are not exploitable.

The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) is internally consistent with the description: a remote, unauthenticated attacker (PR:N) delivers a crafted HTML page that the victim must load (UI:R), triggering a use-after-free (CWE-416) with high confidentiality, integrity, and availability impact. However, a critical qualifier limits real-world severity: the description explicitly states code execution occurs 'inside the sandbox,' and Chromium itself rated this only 'Medium' severity - there is NO evidence of a sandbox escape, so impact is confined to the renderer process rather than the host OS. This creates a notable tension: the 8.8 'High' CVSS score overstates practical risk because the unchanged scope (S:U) plus in-sandbox confinement means an attacker needs a separate chained bug to reach the underlying system. No EPSS score, no CISA KEV listing, no SSVC decision data, and no public POC were provided, so exploitation probability signals are entirely absent. Exploitation status: no public exploit identified at time of analysis. Net assessment: this is a standard-urgency browser patch - important to deploy given ubiquitous Chrome deployment and remote reachability, but not an emergency absent active-exploitation or chained-escape evidence.

An attacker hosts a malicious web page (or injects it via a compromised ad/iframe) and lures a Chrome user to visit it; the crafted HTML triggers a use-after-free in the Streaming component, corrupting memory to achieve arbitrary code execution within the renderer sandbox. Because user interaction is required (UI:R), the victim must actually navigate to the page. No public exploit code was identified at time of analysis, and execution is confined to the sandbox unless chained with a separate escape.