Google Chrome for Android CVE-2026-113225

Exploitation requires the victim to use Google Chrome on Android at a version prior to 156.0.8078.47 and to load attacker-controlled content - the CVSS UI:R and the description's 'via a crafted HTML page' confirm active user interaction (visiting or rendering a malicious page) is mandatory; there is no passive, zero-click vector described. No authentication is required of the attacker (PR:N) and no special victim-side configuration is needed beyond running the default browser. Limiting factors: the required user interaction, the need for the target to be on an unpatched Android build, and that the described impact is confined to reading memory inside the sandbox (C:H only; I:N/A:N), so the standalone bug yields information disclosure rather than code execution or a confirmed sandbox escape.

Signals are consistent and point to a moderate, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, unauthenticated flaw that requires user interaction (the victim must load a crafted HTML page) and yields only a confidentiality impact - reading memory inside the renderer sandbox, with no integrity or availability effect. EPSS is low at 0.22% (12th percentile), the CVE is NOT on the CISA KEV list, and no public exploit has been identified, so there is no evidence of active or imminent mass exploitation. The Chromium 'High' security-severity label reflects the class of bug (memory corruption/CWE-119) rather than demonstrated real-world weaponization, and it is consistent with the information-disclosure-only outcome described. All signals agree: this is a legitimately important browser patch to deploy via normal update cadence, but it is not a drop-everything emergency. One caveat: the description says the attacker can 'potentially read memory inside the sandbox,' meaning impact may be an information leak contained within the sandbox boundary rather than a full escape - this is a disclosure primitive that is often chained with other bugs, so treat the standalone CVSS as a floor, not a ceiling.

An attacker hosts a malicious web page (or injects malicious content into a page the victim already trusts) and lures an Android Chrome user into visiting it. When the page's crafted HTML is parsed, it triggers the memory-corruption condition in the browser, allowing the attacker's script to read out-of-bounds memory within the sandbox and potentially disclose sensitive in-process data. No public proof-of-concept or exploit code has been identified at time of analysis.