Google Chrome CVE-2026-113219

Exploitation requires the victim to open a crafted HTML page in a vulnerable Google Chrome build prior to 156.0.8078.47 (CVSS UI:R confirms user interaction is mandatory - there is no passive/server-side trigger). No authentication is required (PR:N). The critical LIMITING factor is sandbox containment: per the description, arbitrary code execution occurs 'inside the sandbox,' so impact is restricted to the renderer process unless combined with a separate sandbox-escape exploit. Default configurations are affected; no special feature toggle is named, though the flaw resides in the Contacts component, so reaching the vulnerable code path may depend on content that exercises that functionality.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - a typical browser drive-by profile that normally warrants high priority. However, two signals temper this: Chromium itself rated the security severity only Medium, and the description explicitly states code execution occurs 'inside the sandbox,' meaning a successful exploit is confined to the renderer process and would require a separate sandbox-escape bug to achieve full host compromise. The CVSS vector does not model this containment (S:U with full C/I/A:H likely reflects renderer-process impact, not OS-level), so the 8.8 arguably overstates real-world impact for a sandboxed RCE. No EPSS score, KEV listing, or POC was supplied: there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a legitimate patch-worthy browser vulnerability, but absent KEV/POC/EPSS data this is a routine-urgency fix (standard Chrome auto-update cadence) rather than an emergency, and the Medium Chromium rating plus sandbox confinement argue against treating it as a critical standalone threat.

An attacker hosts or compromises a web page containing crafted content that triggers the memory-corruption flaw in Chrome's Contacts component when a user with a vulnerable version (prior to 156.0.8078.47) visits it. Successful exploitation yields arbitrary code execution confined to the browser's renderer sandbox, which would then need to be chained with a sandbox-escape vulnerability to compromise the underlying host. No public exploit code was identified at time of analysis.