Google Chrome CVE-2026-113228

Exploitation requires a user running an affected Chrome build (any version prior to 156.0.8078.47) to actively load attacker-controlled web content - the CVSS UI:R and the description's 'crafted HTML page' confirm victim interaction (visiting/rendering a page) is mandatory; it is not a zero-click flaw. No authentication or special privileges are needed (PR:N), and no non-default configuration is required since the affected Network component is core browser functionality. The principal limiting factor is that code execution is confined to the browser sandbox ('inside the sandbox'), so absent a separate sandbox-escape chain the attacker does not directly gain host-level access; updating to 156.0.8078.47 or later fully remediates.

Signals are mostly aligned toward a genuine but not top-tier priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page - the classic browser drive-by profile. However, the Chromium team rated the security severity as Medium, and the description explicitly scopes code execution to 'inside the sandbox,' meaning the initial primitive is contained by Chrome's renderer sandbox (consistent with S:U/scope-unchanged). This tempers real-world impact: a sandbox escape or chained second bug would be needed for full host compromise, which is not described here. No EPSS score was supplied, so exploitation probability cannot be quantified. The CVE is NOT on CISA KEV and no public POC or exploit code is referenced, so this is 'no public exploit identified at time of analysis.' A patch is confirmed available from the vendor. Net: a real priority for patch management given ubiquitous deployment and a network/UI-only trigger, but the Medium Chromium rating plus sandbox containment and absence of exploitation evidence argue against emergency-level urgency. Note the apparent tension between the 8.8 CVSS and the vendor's Medium rating - the CVSS captures the in-sandbox C/I/A loss, not real-world blast radius, so treat 8.8 as an upper bound.

An attacker hosts or compromises a web page containing specially crafted content that triggers a use-after-free in Chrome's Network component when the victim's browser processes it. The victim merely needs to visit the malicious page (user interaction required, no authentication), after which the attacker can execute arbitrary code within the browser sandbox. No public exploit code has been identified at the time of analysis.