Google Chrome CVE-2026-113240

Exploitation requires the victim to use a Chrome build prior to 156.0.8078.47 and to actively load an attacker-controlled HTML page (UI:R), so there is no fully drive-by, zero-interaction path - user navigation is a hard prerequisite. The use-after-free resides in the Chromecast component, so triggering it depends on that code path being reachable via the crafted page. Critically, the resulting arbitrary code execution is contained 'inside the sandbox' per the vendor, meaning no privilege escalation or host compromise occurs without an additional, separate sandbox-escape vulnerability - this containment is the primary factor limiting real-world impact.

Signals are mixed and should be read carefully. The NVD CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R, reflecting a remotely reachable, low-complexity, unauthenticated flaw that requires only that a user open a crafted HTML page. However, the description explicitly states code execution occurs 'inside the sandbox,' and Chromium's own security team rated this Medium, not High/Critical - meaning the 8.8 likely overstates real-world severity because exploitation yields code execution confined to the renderer sandbox, not a full host compromise, and no sandbox-escape chain is described. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided, so exploitation probability cannot be quantified; there is no public exploit identified at time of analysis. Net: this is a patch-promptly browser bug rather than an emergency - the high CVSS is driven by the network vector and standard Chrome H/H/H impact convention, while the sandbox containment and Chromium's Medium rating indicate meaningfully lower practical risk absent a chained sandbox escape.

An attacker hosts or compromises a web page containing malicious HTML/JavaScript that triggers the use-after-free in the Chromecast component when a victim running a vulnerable Chrome build (before 156.0.8078.47) visits it. Successful exploitation yields arbitrary code execution within the renderer sandbox, which an attacker would typically need to chain with a separate sandbox-escape bug to achieve full system compromise. No public exploit code was identified in the provided data.