Google Chrome CVE-2026-113294

Requires the victim to actively visit or be navigated to an attacker-controlled crafted HTML page (CVSS UI:R), but needs no authentication or prior privileges (PR:N) and works remotely over the network (AV:N). The decisive LIMITING factor is that successful exploitation yields arbitrary code execution only inside the Chrome renderer sandbox - not on the host - so meaningful system compromise requires chaining with a separate sandbox-escape vulnerability. Only Chrome versions prior to 156.0.8078.47 are affected; updated browsers are not exploitable.

Signals are notably conflicting and must be weighed carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields a base score of 8.8 (High), reflecting network-reachable, unauthenticated, low-complexity exploitation requiring only that a victim open a crafted HTML page. However, Google's own Chromium security team rated this 'Low' severity, and the description explicitly states code execution occurs 'inside the sandbox' - i.e., confined to the sandboxed renderer process with no sandbox escape, so it does not by itself grant host compromise. This is the core tension: CVSS treats it as a high-impact RCE, while the vendor's low rating reflects that sandbox containment sharply limits real-world impact absent a chained escape. No EPSS score, KEV listing, POC, or SSVC data was provided. There is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: patch promptly because Chrome is ubiquitous and the auto-update cadence makes this low-effort, but this is a high-CVSS, vendor-rated-low issue whose practical severity depends on being chained with a separate sandbox-escape bug - not an immediate 'drop everything' emergency on its own.

An attacker hosts a malicious web page (or injects crafted content into a compromised/advertising frame) that exploits the improper input validation in Chrome's Loader. When a victim navigates to the page, the flaw triggers arbitrary code execution within the sandboxed renderer process. No public exploit code was identified at time of analysis, and full system compromise would require chaining this with a separate sandbox-escape vulnerability.