Google Chrome CVE-2026-113299

Exploitation requires the victim to open attacker-controlled HTML content in a vulnerable Chrome build (prior to 156.0.8078.47) - reflected in CVSS UI:R, so user interaction (visiting/rendering a page) is mandatory and there is no server-side or zero-click vector. Per PR:N the attacker is unauthenticated and needs no account or prior access. The decisive LIMITING factor is that code execution is contained within the Chrome renderer sandbox: full host compromise is NOT achievable from this flaw alone and would require chaining an additional sandbox-escape vulnerability. No special non-default browser configuration is indicated as required.

Signals conflict sharply and must be weighed carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) depicts a high-severity, network-reachable, no-privilege flaw needing only that a victim open a crafted HTML page - the classic drive-by browser profile. However, Google's own Chromium rating is explicitly 'Low', and the description qualifies the outcome as code execution 'inside the sandbox', meaning the attacker gains execution only within Chrome's renderer sandbox rather than full host compromise. That containment is why the vendor downgrades real-world impact despite the memory-corruption primitive (CWE-119), and it is the single most important nuance here: a sandbox-confined RCE typically requires a second sandbox-escape bug to be dangerous, so the 8.8 overstates standalone risk. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT on CISA KEV and no POC is referenced, so this is not a confirmed in-the-wild threat. Net assessment: patch-worthy and genuinely remote/unauthenticated, but closer to a medium real-world priority than its 8.8 suggests - a 'high-CVSS, vendor-rated-low' case driven almost entirely by sandbox containment. Verify impact scope with the Chrome release notes before escalating.

An attacker hosts a malicious web page (or injects malicious content into an ad or compromised site) that triggers the WebProtect memory-corruption bug when a victim's Chrome browser renders it. Successful exploitation yields arbitrary code execution confined to the renderer sandbox, which on its own exposes in-process browser data but requires a separate sandbox-escape to reach the host OS. No public exploit code is referenced at the time of analysis.