Google Chrome CVE-2026-113272

Exploitation requires a victim using a vulnerable Chrome build (before 156.0.8078.47) to open or be directed to an attacker-controlled crafted HTML page, per the CVSS UI:R requirement - there is no silent or fully-automatic trigger. No authentication is required (PR:N). The decisive LIMITING factor is that resulting code execution is confined 'inside the sandbox' (S:U): the attacker gains control only of the sandboxed renderer/extension process and would need a separate sandbox-escape vulnerability to compromise the underlying host, which is why Chromium rates this Medium despite the high CVSS.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted HTML page - a realistic bar for a browser. However, this high CVSS score contrasts sharply with Google/Chromium's own 'Medium' severity rating, and the gap is explained by the description itself: code execution is confined 'inside the sandbox' (Scope:Unchanged), so this is a renderer-sandbox RCE rather than a full host compromise, which on its own would require chaining with a separate sandbox-escape bug. No EPSS score was supplied, the CVE is not on CISA KEV, and no public exploit is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. On balance this is a genuine but second-tier priority: patch promptly as part of normal Chrome update cadence, but the sandbox confinement and absence of exploitation signals make it lower urgency than the 8.8 number alone implies. Note the conflict explicitly: CVSS 8.8 (High) vs. vendor 'Medium' - treat the sandbox limitation, not the raw score, as the operative risk driver.

An attacker hosts or compromises a web page containing malicious HTML that triggers the memory-corruption bug in Chrome's Extensions component when a victim visits it (UI:R). Successful exploitation yields arbitrary code execution confined to the browser's renderer/extension sandbox, which an attacker would typically pair with a separate sandbox-escape to reach the host. No public proof-of-concept is referenced in the available data.