Google Chrome CVE-2026-113250

Exploitation requires the victim to load attacker-controlled web content that drives Chrome's ANGLE graphics backend (the layer translating WebGL/GPU API calls) along a code path that triggers the use-after-free; this is reachable by any standard web page, so no authentication or special privileges are needed (PR:N). The key LIMITING factors are: (1) user interaction is mandatory (UI:R) - the target must visit or render the malicious page; (2) impact is confined to within the renderer sandbox (scope Unchanged), so arbitrary code execution does NOT by itself compromise the host OS and would typically need to be chained with a separate sandbox-escape vulnerability for full system compromise; and (3) only Chrome versions prior to 156.0.8078.47 are affected - patched builds are not exploitable.

This is a legitimately elevated-risk client-side vulnerability, but not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity flaw requiring no privileges but DOES require user interaction (UI:R) - the victim must visit a crafted page. The scope is Unchanged (S:U) and the description explicitly limits impact to 'inside the sandbox,' so this is memory-corruption code execution within Chrome's renderer sandbox, NOT a full sandbox escape to the host - a critical mitigating factor the raw 8.8 does not convey. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public POC indicated, so exploitation status is: no public exploit identified at time of analysis. Google rated the Chromium security severity only 'Medium,' which conflicts with the externally-assigned 8.8 'High' CVSS - this gap reflects that a sandboxed-renderer UAF, while serious, is lower priority to Google than a sandbox-escape or non-UI bug. No SSVC decision data was supplied. Net: treat as a standard high-priority browser patch (ANGLE UAF bugs are historically chainable with a sandbox-escape bug), not as an actively-exploited zero-day.

An attacker hosts a malicious web page containing crafted content that exercises Chrome's ANGLE graphics layer (e.g., WebGL/GPU shader paths) and lures a victim to visit it via phishing, malvertising, or a compromised site. When the page is rendered, a use-after-free in ANGLE is triggered, letting the attacker corrupt memory and potentially execute arbitrary code within the renderer sandbox. No public exploit code is identified at time of analysis, and user interaction (visiting the page) is required.