Chrome for Android CVE-2026-113173

Requires the victim to open or navigate to an attacker-crafted HTML page in Google Chrome for Android on a version prior to 156.0.8078.47 (UI:R). No authentication or special configuration is needed (PR:N), and default installations are affected. The key LIMITING factors are: (1) mandatory user interaction - the victim must load the malicious page; (2) the platform is specifically Android Chrome; and (3) resulting code execution is confined to the renderer sandbox (S:U), so without an additional sandbox-escape vulnerability the attacker cannot reach the underlying OS, user data outside the sandbox, or other apps.

Signals are mixed and should be weighed carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields a base score of 8.8 (High), reflecting remote, network-reachable, unauthenticated exploitation with only user interaction required. However, this conflicts sharply with the vendor's own rating: Chromium labeled this issue 'Low' severity, and the description explicitly constrains the outcome to code execution INSIDE the renderer sandbox (scope unchanged, S:U) - not full device compromise. That containment is the dominant real-world mitigating factor: sandboxed RCE in Chrome typically requires a second sandbox-escape bug to become a full system compromise, which is why Google rated it Low despite the high calculated CVSS. No EPSS score, KEV listing, or POC indicator is present in the input, so there is no evidence of exploitation probability or active abuse. Net assessment: this is a patch-on-normal-cadence browser bug rather than an emergency - the high CVSS overstates the true priority because the confidentiality/integrity/availability impacts are bounded by the sandbox. The CVSS-vs-vendor-severity discrepancy (8.8 High vs Chromium 'Low') should be reconciled by treating the sandbox boundary as the effective risk ceiling until chained with another vulnerability.

A remote attacker crafts a malicious HTML page and lures an Android Chrome user to open it (via link, ad, or compromised site). Improper input validation in the browser UI is triggered when the page is rendered, allowing the attacker to execute arbitrary code within the confines of the Chrome sandbox. Because UI:R applies, the user must actively navigate to or interact with the attacker-controlled content, and the resulting code execution remains contained in the sandbox absent a further escape. No public exploit code is identified in the provided data.