Google Chrome CVE-2026-113278

Exploitation requires a victim using an affected Google Chrome build (any version prior to 156.0.8078.47) to actively load attacker-controlled content - the crafted HTML page that triggers the use-after-free in the Extensions component (UI:R). No authentication or prior privileges are needed (PR:N). The key limiting factor is sandbox containment: per the description, arbitrary code executes 'inside the sandbox' and Scope is Unchanged, so this bug alone does not compromise the host OS or data outside the renderer - meaningful host-level impact requires chaining a separate sandbox-escape vulnerability. No special non-default Chrome configuration is indicated by the available data.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw that requires user interaction, which is consistent with the description of exploitation via a crafted HTML page. No EPSS probability, CISA KEV entry, or public exploit (POC) was supplied in the input, so exploitation status is 'no public exploit identified at time of analysis' and there is no evidence of active exploitation. An important mitigating signal conflicts with the raw score: the description explicitly states code execution occurs 'inside the sandbox' and the vector keeps Scope Unchanged (S:U), meaning a successful attack is confined to the Chrome renderer sandbox and a separate sandbox-escape bug would be required for full host compromise - the 8.8 therefore overstates host-level risk for a single-bug scenario. Note also that Google/Chromium rated this issue 'Medium' severity while the aggregated CVSS is 8.8 (High); this is a common Chromium-vs-NVD scoring divergence and the vendor's Medium rating reflects the sandbox containment. Because the affected product (Chrome) is ubiquitous, patch urgency is driven by enormous deployment footprint rather than by confirmed in-the-wild use; this should be treated as a routine-but-prompt browser update priority, not an emergency, absent KEV/POC data.

An attacker hosts or compromises a web page containing malicious HTML that triggers the use-after-free in Chrome's Extensions component when a victim visits it. Successful exploitation yields arbitrary code execution within the renderer sandbox; no public proof-of-concept was provided in the input. Because it requires the victim to load the page (UI:R) and the code runs confined to the sandbox, full system compromise would require chaining an additional sandbox-escape vulnerability.