Google Chrome CVE-2026-113263

Exploitation requires a victim running Google Chrome on Android at a version prior to 156.0.8078.47 to actively load a crafted HTML page (UI:R) - there is no drive-by-without-interaction path and no authentication requirement (PR:N). The vulnerability is in the browser 'Core' component and the described outcome is a sandbox escape, so successful code execution outside the sandbox is characterized by the vendor as 'potential' rather than guaranteed, which is the main limiting factor alongside the required user navigation. Exploitation works against default configurations; no special feature toggle or non-default setting is named as a prerequisite.

The CVSS 3.1 base score of 9.6 (Critical) is driven primarily by the scope change (S:C) reflecting a sandbox escape - the description states the flaw allows code execution 'outside the sandbox' - combined with network vector, low complexity, no privileges, and high C/I/A impact. However, this high score directly conflicts with the vendor's own rating of 'Chromium security severity: Medium', which suggests Google's internal assessment of real-world exploitability/impact is lower than the NVD-style vector implies - this discrepancy should be noted and the Medium rating likely reflects practical constraints (user interaction required, exploitation described as 'potentially'). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: this is a patch-promptly item for Android Chrome fleets because sandbox-escape UAFs are historically weaponizable, but the absence of EPSS/KEV/POC signals plus the vendor's Medium rating argue against treating it as an emergency ahead of confirmed exploitation. The gap between the 9.6 CVSS and the vendor Medium severity is the key conflicting signal and should be verified against Google's advisory before escalation.

An attacker hosts or compromises a web page containing crafted HTML that triggers the use-after-free in Chrome's Core component; a victim using Chrome on Android below 156.0.8078.47 visits the page and the freed object is reused to corrupt memory, potentially yielding code execution outside the renderer sandbox. No authentication is required but the victim must actively load the malicious page (UI:R). No public exploit code is identified in the available data.