Google Chrome CVE-2026-113314

Exploitation requires a victim to actively load an attacker-controlled or compromised HTML page in Chrome prior to 156.0.8078.47 that exercises the vulnerable Media component (UI:R user interaction is mandatory per the CVSS vector). No authentication is required (PR:N). The principal limiting factor is that successful code execution is confined to the renderer sandbox (Scope:Unchanged) - full host compromise would require chaining an additional sandbox-escape vulnerability. Users on the patched build (156.0.8078.47 or later) are not affected.

Signals conflict and must be weighed carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 High) describes remote, unauthenticated, low-complexity exploitation requiring only that a victim open a crafted HTML page. However, Google/Chromium independently rated this 'Low' severity, and the description explicitly states code execution is confined 'inside the sandbox' (Scope:Unchanged) - meaning a successful exploit yields control of the renderer process, not the host, and would require a separate sandbox-escape to achieve full system compromise. This is the key tension: the 8.8 CVSS overstates real-world impact relative to the vendor's Low rating and the sandbox containment. No EPSS score, no CISA KEV listing, and no public exploit were provided; exploitation status is therefore 'no public exploit identified at time of analysis.' Net assessment: this is a standard patch-on-cycle browser memory-safety fix, not an emergency. Priority is driven almost entirely by Chrome's ubiquity rather than by exploitation signals, which are absent. Note the inconsistency between the High CVSS and the vendor's Low rating - defenders should treat the vendor severity and sandbox-containment language as the more accurate real-risk indicator.

An attacker hosts or injects a malicious HTML page that drives Chrome's Media component into a use-after-free condition; when a victim visits the page, the freed object is reclaimed with attacker-controlled data to execute code within the renderer sandbox. No public proof-of-concept was identified, and the code execution remains confined to the sandboxed renderer absent a chained sandbox escape.