Google Chrome CVE-2026-113321

Exploitation requires the victim to open a crafted HTML page in a vulnerable Chrome build (prior to 156.0.8078.47), so active user interaction (UI:R) is mandatory - there is no server-side or passive trigger. The flaw resides in the Extensions component and is reachable from web content, needing no authentication or privileges (PR:N). The key limiting factor is that resulting code execution is explicitly confined to the renderer sandbox (Scope:Unchanged); meaningful host compromise additionally requires chaining a separate sandbox-escape vulnerability. Applying the already-available update to 156.0.8078.47 or later fully remediates the condition.

Signals are mixed. The NVD CVSS 3.1 base score is 8.8 (High) with AV:N/AC:L/PR:N/UI:R, indicating a low-complexity, unauthenticated, network-reachable flaw requiring only that a victim open a page - yet Google's own Chromium security team rated this 'Medium', and the description explicitly states code execution occurs 'inside the sandbox' (Scope:Unchanged). That sandbox confinement is the decisive mitigating factor: without a chained sandbox-escape vulnerability, a successful UAF exploit does not directly yield host/system compromise, so the effective real-world impact is lower than the 8.8 suggests. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code was referenced, so exploitation status is: no public exploit identified at time of analysis. SSVC-style read: exploitation=none observed, automatable=no (requires user interaction via crafted page), technical impact=partial (confined to renderer sandbox). Net: this is a legitimate patch-now item because Chrome is ubiquitous and the fix is already shipped, but it is not an emergency on its own - it is a sandboxed-RCE primitive, not confirmed end-to-end system compromise. Conflict to note explicitly: vendor severity 'Medium' vs NVD 'High (8.8)' - the gap is explained by sandbox containment, which CVSS base metrics do not credit.

An attacker hosts a malicious or compromised web page containing crafted HTML/JavaScript that abuses the Extensions component to trigger a use-after-free. A victim running Chrome prior to 156.0.8078.47 visits the page (the required user interaction), the freed object is reclaimed with attacker-controlled data, and arbitrary code executes within the renderer sandbox. No public proof-of-concept exploit was identified at the time of analysis.