Google Chrome CVE-2026-113328

Exploitation requires a user to open attacker-controlled content in Chrome - the CVSS UI:R and the description's 'via a crafted HTML page' confirm victim interaction (visiting/rendering a malicious page) is mandatory; it cannot be triggered without this. No authentication is required (PR:N). The flaw lies in the Privacy component's input validation and results in code execution outside the sandbox (S:C scope change), meaning successful exploitation breaches the renderer sandbox boundary to affect the host. LIMITING FACTORS: the required user interaction, the need to deliver crafted HTML to the target, dependence on a vulnerable version (before 156.0.8078.47), and the vendor's own Medium severity rating suggesting exploitation may be less reliable than the Critical base score implies.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6 Critical) describes a network-reachable, low-complexity, unauthenticated sandbox-escape RCE requiring only that a victim open a crafted HTML page. That signal points to high real-world risk. However, there is a notable conflict: Google/Chromium rates this issue 'Medium' severity, while NVD-style scoring yields 9.6 Critical - STATE EXPLICITLY that the vendor's own severity rating (Medium) is substantially lower than the 9.6 CVSS, likely because the description qualifies impact as 'potentially execute arbitrary code' (not confirmed reliable exploitation) and may reflect mitigations or difficulty not captured in the base vector. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis. Net assessment: patch promptly given Chrome's ubiquity and the sandbox-escape class, but the absence of KEV/POC/EPSS and the vendor's Medium rating suggest this is not currently confirmed as actively exploited - treat as a high-priority patch driven by product footprint rather than confirmed in-the-wild activity.

An attacker hosts a malicious web page (or injects crafted HTML into a compromised/advertising site) and lures a Chrome user to visit it. The crafted HTML triggers improper input validation in the Privacy component, allowing code execution to escape the renderer sandbox and run on the victim's host. No public exploit code was identified in the provided data, and user interaction (visiting the page) is required.