Google Chrome CVE-2026-113319

Exploitation requires the victim to navigate to attacker-controlled or attacker-injected content in a vulnerable Chrome build (prior to 156.0.8078.47) - this is the UI:R user-interaction requirement and is the primary limiting factor. No authentication or elevated privileges are needed (PR:N), and no non-default configuration is required: the Accessibility code path is present in standard Chrome. The most significant limit on impact is architectural rather than configuration-based: successful exploitation yields code execution only INSIDE the renderer sandbox (Scope:Unchanged), so a separate sandbox-escape vulnerability would be required to compromise the underlying operating system.

This is a genuinely high-priority patch target despite the vendor's internal 'Medium' Chromium severity label. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity, unauthenticated exploitation requiring only that a victim visit a crafted HTML page - a trivially satisfiable condition for a web browser. CWE-416 use-after-free in the Accessibility component is a classic memory-corruption primitive that frequently becomes a reliable exploitation path. The key mitigating signal, stated in the description itself, is that code execution occurs INSIDE the renderer sandbox (consistent with Scope:Unchanged); a sandbox escape would be required for full host compromise, which tempers the real-world impact. No EPSS score was provided in the input, and there is no CISA KEV listing and no public proof-of-concept referenced, so there is no evidence of active or imminent exploitation at this time. The apparent tension between the 8.8 CVSS and Google's 'Medium' Chromium rating is expected: Google rates renderer-confined UAF bugs lower precisely because of the sandbox boundary, while CVSS scores the in-sandbox RCE impact as High. Bottom line: patch promptly given Chrome's ubiquity and the low exploitation barrier, but absent KEV/POC/EPSS signals this is driven, routine browser-update urgency rather than an emergency.

An attacker hosts or compromises a web page containing crafted HTML that triggers the use-after-free in Chrome's Accessibility component, then lures a victim to visit it (UI:R) via phishing, malvertising, or a watering-hole. When the page loads, the freed object is reused to corrupt memory and achieve arbitrary code execution within the renderer sandbox. No public exploit code is identified at time of analysis, so weaponization would require independent exploit development, and full system compromise would additionally require chaining a separate sandbox-escape bug.