Google Chrome CVE-2026-113304

Exploitation requires the victim to load a crafted HTML page in Google Chrome on Android prior to version 156.0.8078.47, so user interaction (navigating to or rendering the malicious page) is mandatory (UI:R) - there is no server-side or zero-click path. The flaw is in the GPU component, so content must reach the GPU rendering/compositing path (e.g. WebGL or other GPU-accelerated rendering). Limiting factors: impact is confined to a memory READ inside the GPU sandbox (no write, no sandbox escape, no code execution on its own), the Android platform scope excludes desktop/other builds, and patched versions (156.0.8078.47 and later) are not affected.

This is a genuinely moderate-priority issue, not an urgent one. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity, unauthenticated flaw requiring user interaction, with high confidentiality impact but no integrity or availability impact - consistent with the description's 'potentially read memory inside the sandbox.' Crucially, Chromium rated this severity Medium, and the impact is a memory READ that remains CONTAINED WITHIN the GPU sandbox, so it is an information-disclosure primitive rather than a sandbox escape or RCE. The EPSS score is low (0.22%, 12th percentile), there is no CISA KEV listing, and no public exploit was identified, so all exploitation signals align toward low real-world risk. One signal worth noting: the CVSS marks C:H, but the practical value of reading bounded sandbox memory is typically limited unless chained with other bugs - the 'H' reflects worst-case confidentiality, not confirmed high-value data exposure. No conflicting signals are present; the vector, EPSS, Chromium severity, and absence of KEV/POC are mutually consistent.

An attacker hosts a malicious website containing a crafted HTML page (e.g. with specific WebGL/GPU content) and lures an Android Chrome user to visit it. When the page renders, it triggers the GPU memory-corruption flaw, allowing the attacker to potentially read memory within the GPU sandbox. No public exploit code has been identified, and successful exploitation depends on the victim actively loading the attacker's page.