Google Chrome CVE-2026-113325

Exploitation requires the victim to use Google Chrome on iOS at a version prior to 156.0.8078.47 and to actively navigate to an attacker-controlled web page containing crafted HTML (UI:R) that exercises the browser's SignIn code path. No authentication or special configuration is required (PR:N), but three factors limit real-world impact: (1) mandatory user interaction to visit the malicious page, (2) the information disclosure is confined to memory inside the browser sandbox (S:U), meaning no sandbox escape or code execution is achieved on its own, and (3) only the iOS Chrome build is affected, not desktop or Android.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates network-reachable, low-complexity, unauthenticated exploitation but requires user interaction (visiting a crafted page) and yields only information disclosure (C:H) with no integrity or availability impact - consistent with Chromium's own 'Medium' rating. The exploitation signals reinforce low urgency: EPSS is 0.23% (13th percentile), there is no CISA KEV listing, and no public exploit or POC is referenced. No SSVC decision was supplied in the input. The signals are internally consistent - low EPSS, no KEV, no POC, and a Medium vendor rating all point the same direction - so this is best treated as a routine patch-cycle item rather than an exploited-in-the-wild priority. One caveat: the impact is scoped to a sandbox memory read (C:H but 'inside the sandbox'), meaning real-world value to an attacker likely depends on chaining with a sandbox-escape primitive, which further lowers standalone risk.

A remote attacker hosts a malicious web page and lures a Chrome-on-iOS user into visiting it; the crafted HTML triggers memory corruption in the SignIn component, allowing the attacker to read out-of-bounds memory from within the browser sandbox. No authentication is required, but the victim must actively navigate to the attacker-controlled page. No public POC or exploit code is identified at time of analysis.