Google Chrome CVE-2026-113162

Exploitation requires the victim to actively load attacker-controlled content in Chrome - the CVSS UI:R confirms user interaction (visiting or rendering a crafted HTML page) is mandatory, so there is no zero-click or server-side exposure. No authentication is required (PR:N). The affected versions are all Chrome builds prior to 156.0.8078.47. KEY LIMITING FACTOR: successful code execution is confined to the renderer sandbox (S:U, description states 'inside the sandbox'), so full host compromise additionally requires chaining a separate Chrome sandbox-escape vulnerability - this significantly raises the bar for real-world impact beyond the raw 8.8 score.

This is a genuine patch-priority issue but NOT a drop-everything emergency based on current signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a user visit a crafted HTML page - typical for a browser renderer bug. Two signals pull the real-world risk DOWN: (1) the description explicitly states code execution is 'inside the sandbox' and the CVSS scope is Unchanged (S:U), meaning a successful exploit is confined to the Chrome sandbox and would require a separate sandbox-escape chain to fully compromise the host; (2) Chromium's own assigned severity is 'Medium', notably lower than the 8.8 NVD-style base score, reflecting the sandbox containment. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active or imminent exploitation. CONFLICTING SIGNAL TO NOTE: the 8.8 'High' base score versus Chromium's 'Medium' rating - the discrepancy is explained by sandbox containment, which the base CVSS does not fully capture. Net: treat as a standard high-priority browser update rather than an actively-exploited threat.

An attacker hosts a malicious web page (or injects malicious content into a compromised/ad-served page) that abuses the improper input validation in Chrome's Actor component. When a victim running a vulnerable Chrome version visits the page, the crafted HTML triggers the flaw and the attacker gains arbitrary code execution within the renderer sandbox. No public exploit code was identified in the provided intelligence, and the attacker would still need a separate sandbox escape to affect the underlying OS.