Google Chrome CVE-2026-113206

Exploitation requires the victim to load attacker-controlled HTML content in Google Chrome prior to 156.0.8078.47 (UI:R - a user must visit or be redirected to a malicious page); it works against default configurations with no authentication (PR:N) and no special feature toggle. The key LIMITING factor is that resulting code execution is confined to the renderer sandbox (S:U, vendor-stated 'inside the sandbox'), so a separate sandbox-escape vulnerability is needed for host-level compromise; the required user interaction also prevents fully automated, zero-click mass exploitation.

Signals are moderately consistent but contain one important nuance. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U, C:H/I:H/A:H, base 8.8 High) describes a remote, unauthenticated, low-complexity memory-corruption flaw requiring only that a victim load a crafted HTML page - a classic drive-by browser profile. However, the Chromium team rated the security severity only Medium, and the description is explicit that code execution occurs INSIDE the sandbox (S:U, no scope change), meaning a separate sandbox-escape chain would be needed for full host compromise. This is a genuine conflict worth flagging: the NVD 8.8 reflects renderer-context impact, while the vendor Medium rating and 'inside the sandbox' wording indicate contained, not system-level, impact - the realistic standalone risk is lower than 8.8 suggests. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a credible but not emergency-priority browser bug; patch on the normal Chrome update cadence. Priority rises substantially only if chained with a sandbox escape or if it later appears in KEV.

An attacker hosts or compromises a web page containing malicious HTML that triggers the Omnibox memory-corruption bug; a victim running an unpatched Chrome (prior to 156.0.8078.47) simply visits the page (UI:R) and the attacker achieves arbitrary code execution within the browser's renderer sandbox. No authentication is required, but the attacker's code remains confined to the sandbox unless combined with a separate escape. No public exploit code was identified in the provided data.