Google Chrome CVE-2026-113307

Exploitation requires the victim to open a crafted HTML page in a vulnerable Google Chrome build (any version prior to 156.0.8078.47) that triggers memory corruption in the Extensions component - consistent with the CVSS UI:R flag, user interaction (navigating to or loading the malicious page) is mandatory, so this is not a zero-click flaw. No authentication or special configuration is required (PR:N), but the limiting factor is that the resulting code execution is explicitly confined to the renderer sandbox; absent a chained sandbox-escape, the attacker does not gain code execution on the underlying operating system.

Signals are mostly consistent toward a genuine high-priority browser flaw, with one important caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated bug needing only that a victim load a crafted HTML page - the classic drive-by browser exploitation profile, scoring 8.8 (High). However, the description explicitly states the arbitrary code executes 'inside the sandbox,' and Chromium itself rated the issue only 'Medium' severity; a renderer-sandbox-confined RCE normally requires a second sandbox-escape bug to achieve full host compromise, so the C:H/I:H/A:H / S:U scoring reflects impact within the renderer rather than the underlying OS. This tension between the 8.8 base score and the sandbox-contained reality should be noted explicitly. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Given that the affected product is Google Chrome (near-ubiquitous) and a vendor patch is available, this warrants prompt patching, but in the absence of KEV/EPSS/POC data it should be treated as a routine-but-important browser update rather than an emergency, and the sandbox-only impact lowers the realistic standalone risk relative to the raw 8.8.

An attacker hosts or compromises a web page containing malicious HTML that triggers the memory-corruption flaw in Chrome's Extensions component when a victim visits it with a vulnerable Chrome version (prior to 156.0.8078.47). Successful exploitation yields arbitrary code execution confined to the renderer sandbox, which an attacker would typically chain with a separate sandbox-escape to fully compromise the host. No public exploit code was identified in the provided data.