Google Chrome CVE-2026-113188

Exploitation requires the victim to navigate to or load attacker-controlled crafted HTML content in Google Chrome versions prior to 156.0.8078.47 (UI:R user interaction is mandatory), triggering memory corruption in the GPU component - no authentication or special configuration is needed as this affects default Chrome installations. The key LIMITING factors are: (1) required user interaction - a victim must visit the malicious page; and (2) Scope:Unchanged with code execution occurring 'inside the sandbox,' meaning this bug alone does not escape Chrome's sandbox or reach the underlying OS, so a separate sandbox-escape vulnerability would be required for full host compromise.

This is a genuine priority-tier vulnerability but with an important caveat. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity, unauthenticated exploitation requiring only that the victim load a crafted HTML page - a trivially satisfied condition for a web browser. Google rates the Chromium security severity as High, and the bug class (CWE-119 memory corruption in the GPU component) is historically a reliable path to attacker-controlled code execution. However, the description explicitly states code execution occurs 'inside the sandbox,' which is consistent with the Scope:Unchanged (S:U) metric: this flaw alone does NOT escape Chrome's sandbox or compromise the host, so real-world weaponization typically requires chaining with a separate sandbox-escape bug. On exploitation signals, there is a conflict between availability and certainty: no EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation or widespread automated attacks at this time. The combination of ubiquitous product footprint, a clean high CVSS, and a vendor patch makes this a high-priority patch item, but the absence of KEV/POC/EPSS data means the current threat is potential rather than confirmed. Note the headline 8.8 somewhat overstates standalone impact because the sandbox confines the achieved code execution.

An attacker hosts or injects a malicious web page containing crafted content that drives Chrome's GPU process into a memory-corruption condition; when a victim simply visits the page (UI:R, no authentication required), the attacker can potentially execute arbitrary code within the browser's sandbox. No public exploit code was identified in the provided data, and full host compromise would require pairing this with a separate sandbox-escape vulnerability.