Google Chrome CVE-2026-113248

Exploitation requires the victim to open an attacker-controlled or compromised web page containing crafted HTML in a vulnerable Chrome build (any version before 156.0.8078.47); the vector targets the browser's FileSystem component. The UI:R metric confirms required user interaction (visiting/rendering the page), which is the primary limiting factor along with the fact that resulting code execution is CONFINED TO THE RENDERER SANDBOX - full system compromise additionally requires a separate sandbox-escape vulnerability. No authentication is required (PR:N), and default Chrome configurations are affected; there is no indication a non-default setting is needed.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - the classic drive-by browser profile. However, two signals pull strongly against treating this as a top-tier emergency. First, the description explicitly states code execution is 'inside the sandbox,' meaning a successful exploit is confined to the Chrome renderer process and would require chaining with a separate sandbox-escape bug to achieve full host compromise; the S:U (scope unchanged) metric is consistent with this containment. Second, Google's own Chromium severity rating is 'Low,' which conflicts sharply with the 8.8 CVSS and reflects the sandbox limitation plus likely difficult or constrained trigger conditions - this divergence should be noted: the raw CVSS overstates real-world impact for a sandboxed-only primitive. No EPSS score, KEV listing, or POC indicator was supplied, so there is no evidence of active exploitation or public exploit code. SSVC-style reading: exploitation status is 'none' (no KEV/POC), automatable is plausible for a web-delivered bug but unconfirmed, and technical impact is partial given sandbox confinement. Net: a patch-promptly item appropriate to normal browser update cadence, not a confirmed active-exploitation priority. The CVSS 8.8 is network-vector-driven but the vendor's Low rating and the sandbox boundary are the decisive context.

An attacker hosts or compromises a web page containing malicious HTML that triggers the memory-corruption bug in Chrome's FileSystem component when a victim visits it with a vulnerable Chrome build (prior to 156.0.8078.47). Successful exploitation yields arbitrary code execution confined to the browser's renderer sandbox, which the attacker would then need to pair with a sandbox escape to affect the host. No public exploit code is identified at time of analysis.