Google Chrome CVE-2026-113244

Exploitation requires the victim to actively load an attacker-crafted HTML page in a vulnerable Chrome build (any version prior to 156.0.8078.47), consistent with UI:R in the CVSS vector - there is no fully passive or zero-click path described. No authentication is required (PR:N). The critical LIMITING factor is that successful exploitation yields code execution only INSIDE the renderer sandbox; achieving host-level compromise would additionally require a separate sandbox-escape vulnerability, which is not part of this CVE. This sandbox confinement, combined with the mandatory user interaction, substantially constrains real-world impact and aligns with the vendor's 'Low' severity rating.

This issue carries a notably conflicting risk profile. The input NVD/EUVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields a base score of 8.8 (High), implying full compromise of confidentiality, integrity, and availability. However, the vendor (Chromium) explicitly rates this as 'Low' severity, and the description states the arbitrary code executes INSIDE the sandbox - meaning the attacker gains code execution only within the confined renderer process, NOT on the host OS. A sandbox escape would be required for host compromise and is not described here, which largely explains the vendor's Low rating and directly contradicts the C:H/I:H/A:H impact scoring. Exploitation also requires user interaction (UI:R): the victim must visit an attacker-controlled page. On exploitation signals, no EPSS score, SSVC decision, KEV listing, or POC availability was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: despite the High CVSS, this is a lower-priority issue in practice - sandboxed-only impact plus required user interaction and no known exploitation. Patch promptly as part of routine Chrome updates, but it does not warrant emergency out-of-band response. Verify the impact scoring with the vendor, as the CVSS C/I/A:H ratings appear inconsistent with sandbox-confined execution and the Chromium 'Low' severity label.

An attacker hosts a crafted HTML page and lures a victim to visit it (via phishing link, malvertising, or a compromised site). When the victim's Chrome (prior to 156.0.8078.47) renders the page, improper input validation in a UI component is triggered, allowing the attacker to execute arbitrary code within the browser's renderer sandbox. No public proof-of-concept was identified in the provided data.