Google Chrome CVE-2026-113280

Exploitation requires a victim running Google Chrome prior to 156.0.8078.47 to load attacker-controlled web content (a crafted HTML page) - this user-interaction requirement (UI:R) is the primary limiting factor; no authentication or privileges are needed (PR:N). Critically, successful exploitation yields arbitrary code execution only inside the renderer sandbox (scope unchanged), so breaking out to the host requires chaining an additional sandbox-escape vulnerability. No special non-default configuration is indicated; default Chrome installations rendering the malicious page are affected.

Multiple signals point to a genuine high priority, though with an important caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity flaw needing no privileges, requiring only that a user visit a crafted page - the classic drive-by profile for browser bugs. Chromium labels the severity Critical and the Google tags confirm RCE via a buffer overflow (CWE-119). However, the description explicitly states code executes 'inside the sandbox' and the scope is Unchanged (S:U), so this alone yields renderer-level compromise, not full host takeover, which would require chaining a separate sandbox-escape - this tempers real-world impact relative to the headline 'Critical' label. No EPSS score, no SSVC decision data, and no KEV or POC signal were provided in the input: there is currently no evidence of active exploitation or public exploit code, so exploitation status is 'no public exploit identified at time of analysis.' Given Chrome's ubiquity and the low attack complexity, this remains a patch-now item, but the absence of KEV/POC/EPSS means urgency is driven by product reach and bug class rather than by any confirmed exploitation signal.

An attacker hosts a malicious web page (or injects malicious content into an ad or compromised site) that exercises the vulnerable Paint code path in Chrome. When a victim running a version prior to 156.0.8078.47 simply visits the page, the crafted content triggers memory corruption and executes attacker-controlled code within the renderer sandbox. No public proof-of-concept or active exploitation is identified in the provided data; full system compromise would additionally require a separate sandbox escape.