Google Chrome CVE-2026-113176

Exploitation requires the victim to use Google Chrome on a desktop build prior to 156.0.8078.47 and to load attacker-controlled HTML content that reaches the vulnerable Omnibox code path (UI:R - user must visit or render the crafted page). No authentication is required (PR:N). The principal LIMITING factor is that resulting code execution is confined to the renderer sandbox (S:U, 'inside the sandbox' per the description); achieving host/OS compromise would require chaining a separate sandbox-escape vulnerability. Patched builds (156.0.8078.47 and later) are not affected.

Signals are moderately but not uniformly alarming. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim visit a crafted HTML page - a realistic browser exploitation profile. However, the description explicitly scopes the outcome to arbitrary code execution 'inside the sandbox,' and the vector's S:U (scope unchanged) is consistent with that: this is renderer-level compromise, NOT a sandbox escape, so full host compromise would require a second, separate bug. Chromium's own triage rated this 'Medium' severity, which contrasts with the 8.8 'High' CVSS - the discrepancy is explained by the sandbox containment that CVSS base metrics do not fully capture. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a credible, patch-worthy browser memory-corruption bug that should be remediated via normal Chrome update cadence, but - absent a chained sandbox-escape, EPSS data, or KEV listing - it is not an emergency on its own. STATE EXPLICITLY: EPSS is missing, so exploitation probability cannot be quantified; KEV status is negative; and the CVSS 8.8 overstates real-world impact relative to the vendor's own 'Medium' rating because code execution is confined to the sandbox.

An attacker hosts a malicious web page (or injects malicious content into a page the victim already trusts) that triggers the Omnibox memory-corruption bug when rendered. A victim using an unpatched Chrome build before 156.0.8078.47 visits the page, and the attacker gains arbitrary code execution within the renderer sandbox. No public exploit is identified at time of analysis, and the attacker would still need a separate sandbox-escape to affect the underlying OS.