Google Chrome CVE-2026-113261

Exploitation requires a victim running Google Chrome earlier than 156.0.8078.47 to load an attacker-controlled crafted HTML page that exercises the WebAppInstalls (web-app/PWA install) code path, triggering the use-after-free; per CVSS PR:N no authentication is needed. The primary limiting factor is the required user interaction (UI:R) - the victim must navigate to or render the malicious content - which rules out fully autonomous, unattended exploitation. No non-default configuration is indicated, so default Chrome installations in the affected version range are susceptible once the page is visited; successful 'outside the sandbox' code execution additionally depends on reliably winning the UAF reclaim, which the vendor frames only as 'potential'.

Signals conflict and must be weighed carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6 Critical) describes a network-reachable, low-complexity, unauthenticated memory-corruption bug whose scope change (S:C) reflects the 'execute arbitrary code outside the sandbox' claim - a sandbox escape, which is the most dangerous class of Chrome flaw. However, Google's own Chromium severity rating is only 'Medium', a notable contradiction with the 9.6 Critical CVSS; vendor Chromium severity generally weighs exploitability and real-world preconditions, so the raw 9.6 likely overstates practical risk and the 'potentially' qualifier in the description signals the code-execution outcome is not demonstrated. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Mitigating this, the flaw requires user interaction (UI:R - the victim must visit attacker content), which lowers automatability and argues against widespread opportunistic exploitation. Net: given Chrome's ubiquity and a vendor-confirmed patch, this warrants prompt routine patching as part of normal Chrome update cadence, but the Critical CVSS should be read against the vendor's Medium rating and the absence of exploitation signals - treat as important-but-not-emergency. Note the CWE-416 UAF typically yields renderer-process compromise first; the 'outside the sandbox' phrasing implies a fuller escape and should be verified against the Chromium issue tracker once that entry is public.

An attacker hosts or injects a crafted HTML page that drives the WebAppInstalls component into a use-after-free condition; when a victim running a vulnerable Chrome version visits the page, the freed object is reclaimed and manipulated to corrupt memory and potentially run attacker code outside the browser sandbox. Because UI:R applies, the victim must navigate to the malicious content (e.g., via phishing or a compromised/malvertised site). No public exploit code was identified at time of analysis.