Google Chrome (Android) CVE-2026-113164

Exploitation requires a victim running Chrome for Android on a version prior to 156.0.8078.47 to actively load attacker-controlled HTML content that exercises the vulnerable Voice component (UI:R - user interaction via visiting/opening the crafted page is mandatory, which limits scalability versus a zero-click flaw). No authentication or special privileges are needed (PR:N). The decisive limiting factor is that successful exploitation yields code execution confined to the renderer sandbox (S:U, per the description); without a separately chained sandbox-escape vulnerability, the attacker cannot reach the host OS or other apps, which is why the vendor rates real-world impact Medium.

Signals are mixed and point to a moderate, not top-tier, priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) yields 8.8 (High) and describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - classic drive-by browser risk. However, this directly conflicts with two tempering signals: Google/Chromium themselves rated this 'Medium', and the description explicitly states code execution occurs 'inside the sandbox', meaning the attacker gains control of a confined renderer process, not the host. A sandboxed RCE without a chained sandbox-escape has materially lower real-world impact than the 8.8 score implies - this is the likely reason for the vendor's Medium rating, and defenders should weight the vendor rating here. No EPSS score, no KEV listing, and no public POC were provided, so there is no evidence of active or probable exploitation at this time (absence of these is not proof of safety, but it argues against emergency prioritization). Net: patch in normal cycles promptly given Chrome's ubiquity, but this is a High-CVSS/Medium-real-risk item absent a chained sandbox escape, not a confirmed emergency.

An attacker hosts a malicious web page that abuses the Voice component to trigger memory corruption when rendered by Chrome for Android. A victim is lured (phishing link, malvertising, or compromised site) into visiting the page, and the attacker achieves arbitrary code execution within the renderer sandbox. No public exploit code was identified in the provided data, and absent a separate sandbox-escape the attacker remains confined to the renderer process.