Google Chrome CVE-2026-113218

Exploitation requires the victim to actively load a crafted HTML page in a vulnerable Google Chrome build prior to 156.0.8078.47 (UI:R / UI:P), so it is not a drive-by against a service - it depends on social engineering or a compromised/malicious site. The use-after-free is in the DataTransfer interface, which backs clipboard and drag-and-drop operations, so the trigger involves JavaScript exercising those data-transfer paths. The decisive limiting factor is that resulting code execution is confined to the renderer sandbox (S:U, 'inside the sandbox' per vendor text); meaningful host impact requires chaining a separate sandbox-escape vulnerability, which is not provided here.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction, scoring 8.8 - consistent with a browser renderer bug triggered by visiting a page. However, a critical nuance tempers this: the description explicitly states code execution occurs 'inside the sandbox,' meaning this alone does NOT yield host compromise and would need to be chained with a separate sandbox-escape to achieve full RCE on the system. This also aligns with Chromium's own 'Medium' internal severity rating, which conflicts with the elevated 8.8 CVSS score - the discrepancy is best explained by the sandbox confinement limiting real-world impact. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. Net assessment: patch promptly because Chrome is ubiquitous and UAF bugs are historically exploitable, but this is a sandboxed renderer bug (not an immediate full-system takeover) and currently shows no evidence of active exploitation, placing it as important-but-not-emergency relative to confirmed in-the-wild Chrome zero-days.

An attacker hosts or injects a crafted HTML page containing JavaScript that manipulates the DataTransfer object (e.g., via drag-and-drop or clipboard operations) to trigger a use-after-free. When a victim running a vulnerable Chrome build (prior to 156.0.8078.47) visits the page, the freed memory is reclaimed and reused to corrupt renderer state, allowing arbitrary code execution within the renderer sandbox. No public proof-of-concept is referenced, and full system compromise would require an additional sandbox-escape primitive.