Google Chrome CVE-2026-113182

Exploitation requires a victim using Google Chrome prior to 156.0.8078.47 to load attacker-controlled HTML content that exercises the vulnerable 'Passwords' component (UI:R - the user must actively visit or render the crafted page; this is the primary limiting factor). No authentication or prior privileges are required (PR:N). A critical limiting factor is that, per the vendor description, the resulting arbitrary code execution is confined to the browser sandbox - converting this into full host compromise requires chaining a separate sandbox-escape vulnerability, not provided here. Patched builds (156.0.8078.47 and later) are not affected.

Multiple signals must be weighed carefully here. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8 High) indicates a network-reachable, unauthenticated flaw requiring only that a user open a crafted page, with full confidentiality/integrity/availability impact. However, this HIGH rating conflicts sharply with the description's two key qualifiers: Google/Chromium rated the severity 'Low', and the code execution is explicitly confined 'inside the sandbox' - meaning the attacker gains renderer-process compromise, not full host takeover, unless chained with a separate sandbox-escape bug. This containment materially reduces real-world impact versus what the 8.8 score alone implies. No EPSS score, SSVC decision data, KEV listing, or POC was provided; exploitation status is therefore 'no public exploit identified at time of analysis.' Chromium memory-corruption renderer bugs are frequently hardened by the browser's multi-process sandbox and are non-trivial to weaponize into full RCE. Net assessment: patch promptly because Chrome is ubiquitous and UI:R (a single malicious page view) is a low bar, but this is not a drop-everything emergency in isolation - the Low Chromium rating, sandbox confinement, and absence of any exploitation evidence suggest moderate rather than critical real-world priority. Verify the sandbox-containment caveat against the vendor advisory before deprioritizing.

A remote attacker hosts a malicious web page (or injects crafted content into a compromised/ad-served frame) that triggers the memory-corruption flaw in Chrome's Passwords component when a victim browses to it. Exploitation requires user interaction (UI:R) - the victim must load the page - but no authentication. Per the description, successful exploitation yields arbitrary code execution confined to the renderer sandbox; a full host compromise would require chaining an additional sandbox-escape vulnerability. No public exploit code was identified in the provided data.