Google Chrome CVE-2026-113209

Exploitation requires the victim to actively load an attacker-controlled crafted HTML page in Google Chrome on iOS at a version below 156.0.8078.47; the bug triggers during the browser's Navigation processing. Key limiting factors: user interaction is mandatory (UI:R - the user must visit the malicious page), the impact is confined to reading memory inside the browser sandbox with no sandbox escape (Scope Unchanged) and no write/integrity or availability impact, and only the iOS build of Chrome is affected. No special target-side configuration is needed beyond running a vulnerable version.

This is a genuinely moderate-priority issue, not an overhyped high-CVSS flaw. The signals are internally consistent and point to limited real-world risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity, unauthenticated bug that requires user interaction and yields confidentiality impact only (memory read), with no integrity or availability impact and no sandbox escape (S:U). EPSS reinforces low urgency at 0.22% (11th percentile), and the vulnerability is NOT on the CISA KEV list, with no public exploit code referenced in the provided sources. Chromium itself rated the security severity only Medium, which aligns with an in-sandbox information leak rather than remote code execution. One point to verify: the CVSS assigns C:H, but the description characterizes the impact as merely 'potentially read memory inside the sandbox,' a contained info-leak that many analysts would score C:L - treat C:H as possibly generous. No SSVC decision data was supplied in the input. Overall: patch in the normal cycle; this does not warrant emergency response.

An attacker hosts or injects a crafted HTML page and lures a Chrome-for-iOS user into visiting it (e.g., via a link, ad, or compromised site). When Chrome's Navigation component processes the page, the memory-corruption condition is triggered, allowing the attacker to read adjacent memory contents within the browser sandbox - potentially leaking sensitive data that could aid further attacks. No public proof-of-concept was identified in the provided sources, and user interaction (visiting the page) is required.