Chrome for Android CVE-2026-113163

Exploitation requires the victim to use Google Chrome on Android at a version prior to 156.0.8078.47 and to be lured into loading an attacker-controlled HTML page that exercises the WebGL rendering path (UI:R) - WebGL is enabled by default, so no special non-default configuration is needed. The primary limiting factors are: (1) mandatory user interaction (the target must open the malicious page), and (2) code execution is confined to the renderer sandbox per the description and Unchanged scope, so without an additional sandbox-escape chain the attacker cannot directly reach the underlying Android OS or other applications. Authentication is not required (PR:N).

This is a genuine high-priority vulnerability, though with important nuance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a remote, low-complexity, unauthenticated attack requiring only that a victim visit a crafted HTML page - a trivially satisfiable condition for a web browser. Google rated the underlying Chromium severity as High. However, the description explicitly states code execution occurs 'inside the sandbox,' which is consistent with the Unchanged scope (S:U): this is a renderer-process compromise, NOT a full host takeover, and absent a chained sandbox-escape the attacker does not gain OS-level control. No EPSS score, SSVC decision, KEV listing, or public POC was provided in the input, so exploitation likelihood cannot be quantified from the data. Exploitation status is therefore 'no public exploit identified at time of analysis' - but note that browser use-after-free bugs reported directly by Google's internal security team are historically attractive targets and frequently weaponized after patch disclosure, so the absence of a POC signal should not be read as low risk. Net assessment: treat as a real priority for Android Chrome fleets given ubiquity and low attack complexity, while recognizing the sandbox containment limits blast radius relative to a scope-changed RCE.

An attacker hosts a malicious web page containing JavaScript that drives WebGL into a use-after-free condition, then lures an Android Chrome user to visit it (via link, ad, or compromised site). When the page loads, the freed object is reclaimed and manipulated to achieve arbitrary code execution within the Chrome renderer sandbox. No public exploit code was identified in the provided data, and successful exploitation requires the victim to actually open the page (UI:R).