Google Chrome CVE-2026-113296

Exploitation requires the victim to actively load attacker-controlled crafted HTML in Google Chrome versions prior to 156.0.8078.47 (UI:R) - there is no default-configuration, zero-click path. No authentication is required (PR:N). The impact is further limited in two ways: it is a memory-read/disclosure only (no integrity or availability impact, I:N/A:N), and the read is bounded to memory inside the renderer sandbox, so the flaw alone does not achieve code execution or sandbox escape and would typically need to be chained with a sandbox-escape bug for higher impact. Patched Chrome installations (156.0.8078.47 and later) are not affected.

Signals are consistent and point to a genuinely moderate - not critical - issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) shows network-reachable, unauthenticated exploitation requiring user interaction (visiting a crafted page), with a pure confidentiality impact (C:H, I:N, A:N) - this is a memory-disclosure (info-leak) bug, not code execution. Crucially, Google/Chromium rated the security severity 'Low', and the impact is explicitly bounded to reading memory INSIDE the sandbox, meaning it does not itself escape Chrome's sandbox. EPSS reinforces low urgency at 0.22% (11th percentile). There is no CISA KEV listing and no public exploit identified, so no active-exploitation pressure. The C:H rating in the vector sits in mild tension with the vendor's 'Low' severity and the 'potentially read memory inside the sandbox' wording, which suggests a constrained rather than arbitrary read - treat the confidentiality impact as real but limited. Net: a legitimate patch-in-normal-cycle browser fix, not an emergency; priority is driven almost entirely by Chrome's ubiquity rather than by exploitation signals.

An attacker hosts or compromises a web page containing crafted HTML that triggers the memory-corruption flaw in Chrome's Actor component when a victim visits it. The bug lets the attacker read adjacent memory within the renderer sandbox, potentially leaking sensitive in-process data. No public exploit code has been identified, and successful exploitation requires the victim to actively load the malicious page.