Google Chrome CVE-2026-113306

Exploitation requires the victim to actively open or be redirected to an attacker-crafted HTML page (CVSS UI:R), making user interaction the primary limiting factor; no authentication is required (PR:N) and it works against default Chrome configurations reachable over the network (AV:N/AC:L). The decisive limiting factor is that successful code execution is confined to the renderer sandbox (scope unchanged, S:U) - reflected in Chromium's 'Low' severity rating - so by itself it does not escape to the host or OS and would need to be chained with a separate sandbox-escape to achieve full compromise. Affected builds are Chrome desktop prior to 156.0.8078.47.

Signals conflict sharply and must be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) describes network-reachable, low-complexity, unauthenticated code execution requiring only that a victim open a crafted HTML page - the standard scoring for a Chrome renderer RCE. However, the description explicitly states execution occurs 'inside the sandbox' (scope unchanged, S:U), and Chromium's own security triage rated this 'Low' severity. That vendor rating is the key tempering signal: sandboxed code execution without a paired sandbox-escape does not yield host compromise, so the effective real-world impact is well below what the 8.8 implies. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of exploitation probability or active abuse - exploitation status is 'no public exploit identified at time of analysis.' Net judgment: this is a high-CVSS but comparatively low-real-risk issue in isolation; it becomes dangerous mainly when chained with a separate sandbox-escape bug. Given Chrome's ubiquity and a patch being available, routine prompt patching is the appropriate response rather than emergency prioritization. Note the discrepancy explicitly: CVSS 8.8 (High) vs. vendor Chromium severity 'Low' - the gap is explained by sandbox confinement, not by a data error.

An attacker hosts or injects a crafted HTML page and lures a victim into visiting it, triggering improper input validation in Chrome's Network component to run attacker-controlled code within the renderer sandbox. No public exploit code was identified at the time of analysis, and the achieved execution is confined to the sandbox, so meaningful compromise would require chaining a separate sandbox-escape vulnerability.