Google Chrome CVE-2026-113291

Exploitation requires the victim to use Google Chrome prior to version 156.0.8078.47 and to actively navigate to an attacker-controlled page containing crafted HTML that exercises the FullScreen feature (UI:R confirms required user interaction). No authentication is needed (PR:N). The key LIMITING factor is sandbox containment: the description states code execution occurs 'inside the sandbox', so absent a chained sandbox-escape vulnerability the attacker does not gain code execution on the host OS. The required user interaction and sandbox boundary meaningfully reduce realistic impact relative to the 8.8 base score.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) paints this as a high-severity, network-reachable, unauthenticated memory-corruption flaw requiring only that the victim open a crafted HTML page. However, two signals strongly temper real-world priority and CONFLICT with that headline number: (1) the description explicitly scopes code execution to 'inside the sandbox', meaning a successful exploit is contained within Chrome's renderer sandbox and does NOT by itself yield host compromise without a separate sandbox-escape chain, and (2) Google/Chromium rated this 'Low' security severity - a notable divergence from the 8.8 CVSS. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT on the CISA KEV list and no public POC is referenced, so there is no public exploit identified at time of analysis. Net assessment: despite Chrome's ubiquity and the 8.8 score, the vendor's 'Low' rating plus sandbox containment and the absence of KEV/POC/EPSS signals indicate this is a patch-in-normal-cycle issue rather than an emergency, though its ubiquity warrants timely patching. Verify the 'Low' severity rationale against the Chrome release notes, as the vendor rating and CVSS base score disagree.

An attacker hosts or compromises a web page containing malicious HTML that abuses Chrome's FullScreen handling to trigger memory corruption when a victim browses to it. Because UI:R applies, the victim must actively visit the page, after which the attacker may execute arbitrary code confined to the renderer sandbox. No public proof-of-concept exploit is referenced in the provided intelligence.