Google Chrome CVE-2026-113256

Exploitation requires a victim using a Google Chrome version prior to 156.0.8078.47 to visit or load an attacker-controlled crafted HTML page (UI:R - user interaction is mandatory, no zero-click path). No authentication or special privileges are needed (PR:N), and the flaw is reachable over the network against default Chrome configurations, triggering the use-after-free in the Permissions component. The key limiting factor is sandbox containment: successful exploitation yields code execution only INSIDE the renderer sandbox, so full host compromise additionally requires chaining a separate sandbox-escape vulnerability. Exploitation is prevented by updating to 156.0.8078.47 or later.

Signals are moderately conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity flaw needing no privileges, yielding a High 8.8 base score, and the description confirms remote arbitrary code execution via a crafted HTML page - a classic drive-by profile. However, two factors temper real-world severity: (1) Chromium's own security team rated this 'Low', and (2) the description explicitly states code executes 'inside the sandbox,' meaning this alone does NOT yield full host compromise without a separately chained sandbox-escape - a significant limiting factor the raw 8.8 does not reflect. User interaction (UI:R) is required, so there is no wormable/zero-click path. No EPSS score was provided, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit (POC) referenced, indicating no confirmed active exploitation. Net assessment: patch promptly as part of normal Chrome update cadence given ubiquity and RCE potential, but this is not an emergency-tier issue in isolation - the Low Chromium rating plus sandbox containment suggests lower practical risk than the 8.8 implies, and the vendor-severity-vs-CVSS gap should be noted when prioritizing.

An attacker hosts or compromises a web page containing malicious HTML/JavaScript that triggers the use-after-free in Chrome's Permissions component when a victim visits it, achieving arbitrary code execution within the renderer sandbox. To escape the sandbox and compromise the host, the attacker would need to chain a second vulnerability. No public exploit code was identified in the provided data, and exploitation requires the victim to actively load the attacker-controlled page (UI:R).