Google Chrome CVE-2026-113178

Exploitation requires the victim to be running Google Chrome on macOS at a version prior to 156.0.8078.47 and to actively load an attacker-controlled HTML page (UI:R) - there is no drive-by-without-interaction path and no authentication is needed (PR:N). The limiting factors are significant: user interaction (visiting/rendering the malicious page) is mandatory, the impact is confined to a read of memory inside the renderer sandbox (no sandbox escape, no write/code-execution), and the flaw is platform-specific to the Mac build. These constraints, combined with low EPSS and no known exploit, keep realistic risk well below the network/unauthenticated CVSS framing.

This is a genuine but moderate-priority vulnerability, and multiple independent signals agree on that assessment rather than conflict. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity, unauthenticated bug that nonetheless requires user interaction (loading a crafted HTML page) and yields only confidentiality impact (C:H) with no integrity or availability effect. Critically, the description constrains the impact further than the raw C:H suggests: the attacker 'potentially' reads memory *inside the sandbox*, meaning the Chromium sandbox is not escaped and data exposure is limited to the renderer process, which is why Google rated it Medium rather than High/Critical. The EPSS score of 0.19% (9th percentile) is low and consistent with the absence of KEV listing and the absence of any public exploit - there is no evidence of active exploitation or weaponization. No SSVC decision data was provided in the input. Overall the signals are coherent: a real memory-safety info-leak worth patching in the normal cycle, not an emergency. The primary nuance for defenders is that 'potentially read memory inside the sandbox' indicates an information-disclosure read primitive, not code execution; such bugs are often more valuable chained with a separate sandbox-escape than exploited alone.

An attacker lures a macOS Chrome user into visiting a malicious or compromised web page (e.g., via phishing, malvertising, or a watering-hole), where crafted HTML triggers the memory-corruption flaw in the Views component. The renderer reads out-of-bounds memory within the sandbox, potentially leaking sensitive in-process data such as other sites' content, tokens, or address-space information useful for defeating ASLR. No public exploit code is identified at time of analysis, and successful exploitation requires the victim to actively load the attacker-controlled page.