Google Chrome CVE-2026-113260

Exploitation requires a victim to actively open or render an attacker-crafted HTML page in a vulnerable Chrome build (any version prior to 156.0.8078.47); this user-interaction requirement (CVSS UI:R) is the primary limiting factor. No authentication or special configuration is needed, and default Chrome configurations are affected. A critical LIMIT is that the description scopes code execution to 'inside the sandbox' - the renderer process - so a successful attacker remains confined and would need a chained sandbox-escape vulnerability to compromise the underlying OS or access data outside the renderer.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw requiring only that a victim open a crafted HTML page - a classic drive-by browser profile. However, two signals pull the real-world priority DOWN and directly conflict with the 8.8 base score: (1) Google/Chromium explicitly rated this 'security severity: Low', and (2) the description states code execution occurs 'inside the sandbox', meaning a successful attacker is confined to the renderer process and would need a separate sandbox-escape bug to reach the host - a limitation the CVSS vector does not capture (CVSS keeps S:U and C/I/A:H for in-sandbox compromise). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation or weaponization. Net assessment: patch on the normal Chrome auto-update cadence, but this is a high-CVSS / low-real-risk item for most environments - the vendor's own 'Low' rating plus sandbox confinement make it far less urgent than the 8.8 number implies. Verify: the 8.8 base score and the vendor 'Low' severity are in tension; the sandbox-confined impact is the likely reason and should be weighed over the raw CVSS number.

An attacker hosts a malicious web page (or injects malicious content into a compromised/ad-served page) that triggers the memory-corruption bug in Chrome's Core component when rendered. A victim simply visiting the page could have attacker-controlled code executed within the browser's sandboxed renderer process; full host compromise would additionally require a separate sandbox-escape vulnerability. No public exploit code was identified in the provided data.