Google Chrome CVE-2026-113293

Exploitation requires the victim to use Google Chrome on Windows at a version prior to 156.0.8078.47 and to actively load attacker-controlled content - the user must navigate to a crafted HTML page that exercises the ANGLE graphics backend (WebGL/GPU-accelerated rendering), so the flaw is reached through default browsing behavior but still depends on this user interaction (UI:R). Key limiting factors: (1) code execution is confined to the renderer sandbox, so no host compromise occurs without an additional sandbox-escape chain; (2) it is Windows-specific per the advisory; and (3) the user must open the malicious page. No authentication is required (PR:N).

CVSS 3.1 scores this 8.8 (High) with a fully remote, low-complexity, unauthenticated vector (AV:N/AC:L/PR:N) requiring only user interaction (UI:R) - i.e., a victim visiting a crafted HTML page - which is a realistic and common delivery path for browser bugs. However, a critical mitigating detail in the description tempers the raw score: code execution occurs INSIDE the Chrome sandbox (scope unchanged, S:U), so by itself this does not yield host compromise; a full attack requires chaining it with a separate sandbox-escape vulnerability. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The absence of EPSS/KEV data means exploitation probability cannot be quantified from the inputs - it is MISSING, not low. Net: this is a legitimate priority because Chrome is ubiquitous and the vendor rates it High with a patch already shipped, but the real-world impact is gated by the sandbox and by the need for user interaction, placing it below a wormable/network-service RCE. Routine prompt patching is warranted rather than emergency response, absent evidence of a chained exploit.

An attacker hosts or compromises a web page containing malicious WebGL/graphics content that triggers the use-after-free in Chrome's ANGLE graphics layer; a Windows user running a vulnerable Chrome build (prior to 156.0.8078.47) visits the page and the attacker gains arbitrary code execution within the renderer sandbox. To achieve full system compromise the attacker would then need to chain a separate sandbox-escape bug. No public exploit code was identified in the provided data.