Google Chrome CVE-2026-113245

Requires the victim to open an attacker-crafted HTML page in a vulnerable Chrome build (prior to 156.0.8078.47), consistent with UI:R in the CVSS vector - this user-interaction requirement is the primary limiting factor. No authentication is required (PR:N). The flaw resides in the DevTools component and memory corruption (CWE-119). Critically, successful exploitation yields code execution only INSIDE the renderer sandbox (S:U, no scope change) - it is not a sandbox escape, so full host compromise would require chaining a separate escape vulnerability. Default configurations are affected; no special non-default setting is named as a prerequisite.

Signals conflict and must be read together. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 High) frames this as a network-reachable, unauthenticated code-execution flaw requiring only that a victim open a crafted page - superficially a high priority. However, the description and Chromium's own 'Low' security-severity rating materially lower the real-world risk: code execution is explicitly confined 'inside the sandbox' and the scope is Unchanged (S:U), meaning this is NOT a sandbox escape and does not by itself yield host compromise. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no POC is referenced, so this is no public exploit identified at time of analysis - there is no evidence of active exploitation. Net assessment: patch as part of normal Chrome update cadence, but this is closer to a high-CVSS/low-real-risk issue than an emergency; the headline 8.8 overstates urgency given the sandbox containment and Chromium's Low rating. The key discrepancy - CVSS 8.8 High versus vendor severity Low, driven by sandbox confinement - should be noted when prioritizing.

An attacker hosts a malicious HTML page and lures a Chrome user (versions prior to 156.0.8078.47) into visiting it, triggering memory corruption in the DevTools component. Successful exploitation runs attacker-controlled code within the browser's renderer sandbox, but does not escape it, so impact is contained to the sandboxed process absent a separate chained escape. No public exploit code is identified at time of analysis.