Google Chrome CVE-2026-113301

Exploitation requires a user to load attacker-controlled HTML in a vulnerable Chrome build prior to 156.0.8078.47, exercising the WebAppInstalls component - consistent with the CVSS UI:R requirement for victim interaction (visiting or rendering a malicious page). Limiting factors: resulting code execution is confined 'inside the sandbox' per the vendor, so this single bug does not grant host-level compromise without an additional sandbox-escape; it also only affects Chrome versions below the fixed 156.0.8078.47, and user interaction (navigating to the page) is mandatory. No special non-default configuration is indicated.

Multiple signals align to make this a genuine patch priority, though with important nuance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U) describes a network-reachable, low-complexity flaw requiring only that a victim visit a crafted HTML page - no authentication - yielding a score of 8.8 (High) with full C:H/I:H/A:H impact. However, the description explicitly states code execution occurs 'inside the sandbox,' which materially limits real-world impact: a single renderer-level memory-corruption bug does not by itself escape Chrome's sandbox to compromise the host, and would typically need to be chained with a separate sandbox-escape to achieve full system compromise. Chromium's own triage rated this 'Medium' severity, which contrasts with the 8.8 CVSS High - a conflict worth noting and best explained by the sandbox containment. No EPSS score, KEV listing, or POC indicator was provided in the input, so there is no evidence of active exploitation or public exploit code at this time. Net assessment: real priority because of ubiquitous deployment and trivial delivery (drive-by page), but not an emergency single-bug RCE - the sandbox boundary and absence of exploitation signals reduce immediate urgency relative to the raw 8.8.

An attacker hosts or compromises a web page containing malicious HTML that triggers the WebAppInstalls memory-corruption flaw when rendered by a vulnerable Chrome build. A user is lured to the page (phishing link, malvertising, or compromised site) and, upon rendering, the attacker achieves arbitrary code execution confined to the browser sandbox. No public exploit was identified at time of analysis; practical host compromise would require chaining this with a separate sandbox escape.