Chrome for iOS CVE-2026-113268

Exploitation requires a user of Google Chrome for iOS prior to version 156.0.8078.47 to navigate to or load an attacker-crafted HTML page (CVSS UI:R) - there is no authentication requirement (PR:N) and no special product configuration is needed, so default installations are affected. The key limiting factors are: (1) mandatory user interaction (the victim must open the malicious page); (2) the resulting code execution is explicitly confined to the browser sandbox (S:U), so meaningful host compromise would require chaining a separate sandbox-escape vulnerability; and (3) the issue is specific to the iOS build of Chrome. These constraints materially reduce realistic impact relative to the 8.8 base score.

The NVD CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates this High, driven by remote network vector, low complexity, no privileges, and full C/I/A impact requiring only user interaction. However, this directly conflicts with the vendor's own 'Chromium security severity: Low' rating, and the conflict is explained by two factors the raw CVSS score obscures: (1) the description explicitly states code execution occurs 'inside the sandbox' (consistent with S:U - no scope change), meaning a full-device compromise would require an additional sandbox-escape chain not covered here; and (2) iOS browsers are required by Apple to use the WebKit engine, so a 'Navigation' memory-corruption bug in Chrome's iOS build has a different and more constrained exploitation surface than the same class of bug on desktop Blink. No EPSS score, KEV listing, or POC was provided in the input, so there is no positive signal of real-world exploitation. Net assessment: this is a sandbox-contained, user-interaction-gated memory corruption that is lower real-world priority than the 8.8 would suggest - patch on the normal auto-update cadence rather than treating it as an emergency. VERIFY: the 8.8/Low divergence should be reconciled against the Google advisory before escalation.

An attacker hosts a crafted HTML page and lures a Chrome-for-iOS user to visit it (e.g., via a phishing link or malvertising). When the browser processes the page's navigation logic, a memory-corruption condition (CWE-119) is triggered, allowing the attacker to execute arbitrary code within the browser's renderer sandbox. No public exploit code was identified in the provided data, and exploitation requires the victim to actively load the attacker-controlled page (UI:R).