Google Chrome CVE-2026-113273

Exploitation requires a victim using an affected Chrome build (prior to 156.0.8078.47) to load attacker-controlled web content that exercises the vulnerable ANGLE graphics path - the UI:R metric confirms user interaction (visiting/rendering a crafted HTML page) is mandatory, which is the primary limiting factor. No authentication or special privileges are needed (PR:N, unauthenticated). A key impact limitation: code execution is confined to the browser sandbox (renderer process) per the description, so achieving full host-level compromise requires an additional, separate sandbox-escape vulnerability not covered by this CVE.

This is a genuine priority despite the absence of exploitation signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw (CWE-119) requiring only that a victim visit a crafted HTML page - the classic drive-by browser-exploit profile, which keeps real-world risk elevated even with UI:R. Google rates the Chromium severity as High and a vendor patch is available (fixed in 156.0.8078.47). Countervailing signals: there is no CISA KEV listing, no EPSS score was provided, and no public exploit code is referenced, so there is no evidence of active exploitation at this time. One important scoping caveat the base score understates: the description explicitly states code execution occurs 'inside the sandbox,' meaning a successful exploit is confined to the renderer process and would require a separate sandbox-escape chain to achieve full host compromise - the C:H/I:H/A:H rating reflects renderer-context impact, not host takeover. Net assessment: patch promptly as a high-priority browser update, but this is standard high-severity browser hardening rather than confirmed in-the-wild emergency; EPSS/KEV data is missing, so exploitation probability cannot be quantified from the provided inputs.

An attacker hosts or compromises a web page containing specially crafted content that triggers the ANGLE memory-corruption bug when rendered by a vulnerable Chrome build. A victim is lured into visiting the page (via phishing, malvertising, or a watering-hole), and the malformed input corrupts memory in the renderer, allowing arbitrary code execution within Chrome's sandbox. No public exploit code is identified at time of analysis, and full host compromise would additionally require chaining a sandbox escape.