Google Chrome CVE-2026-113255

Exploitation requires the victim to open attacker-controlled content rendered through Chrome's CustomTabs component on Android (UI:R / user interaction), making this a drive-by style vector rather than fully autonomous: the target must visit or be redirected to a crafted HTML page. No authentication is required (PR:N). The primary limiting factor is that successful code execution is confined to the sandboxed renderer process (Scope:Unchanged, 'inside the sandbox') - achieving host device compromise additionally requires chaining a separate sandbox-escape vulnerability. Platform is limited to Chrome on Android below version 156.0.8078.47; updated builds are not affected.

Multiple signals must be weighed carefully here. The provided CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw that requires user interaction, which is consistent with the description: a remote attacker lures a victim to a crafted HTML page. However, there is a notable tension between the CVSS 8.8 ('High') and Google's own assigned 'Chromium security severity: Medium,' and the description explicitly scopes code execution to 'inside the sandbox.' The CVSS C:H/I:H/A:H with Scope:Unchanged reflects full compromise of the renderer/sandboxed process but NOT a sandbox escape to the host - a critical mitigating factor the raw 8.8 does not convey on its own. No EPSS score, KEV listing, or POC indicator was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Without a chained sandbox-escape bug, standalone impact is contained by Chrome's multi-process sandbox. Net assessment: this is a legitimate patch-worthy memory-corruption bug in an ubiquitous product and should be remediated on Chrome's normal update cadence, but in the absence of KEV/EPSS/POC signals and given the vendor 'Medium' rating and sandbox containment, it is not an emergency drop-everything priority. Treat the 8.8/Medium divergence as expected (sandboxed RCE), not a data error.

A remote attacker hosts or compromises a web page containing content crafted to trigger the use-after-free in Chrome's CustomTabs component, then entices an Android user to open it (via link, ad, or embedded CustomTab). When the victim's Chrome renders the page, the freed object is reused, allowing the attacker to execute arbitrary code within the sandboxed renderer process. No public exploit identified at time of analysis; exploitation requires victim interaction (visiting the page) and, for host-level compromise, would need to be chained with a separate sandbox-escape vulnerability.