Google Chrome CVE-2026-113333

Exploitation requires the victim to visit or be redirected to an attacker-controlled HTML page while using a vulnerable Chrome build (prior to 156.0.8078.47); the memory-corruption path lives in the Extensions component, so the crafted page must trigger that code path. The key limiting factor is mandatory user interaction (UI:R) - the attack cannot succeed without the user loading the malicious page - and the impact is confined to reading memory inside the sandbox (C:H only; no code execution, data modification, or crash from this bug alone), so it is most dangerous when chained with a separate sandbox-escape vulnerability. No authentication is required (PR:N) and default Chrome configurations are affected.

This is a genuinely medium-tier issue, not a high-priority emergency, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, unauthenticated flaw that requires user interaction (visiting a crafted HTML page) and yields a confidentiality-only impact (C:H, I:N, A:N) - meaning an attacker can read memory inside the renderer/extensions sandbox but cannot modify data or crash the process on its own. Google's own Chromium rating of Medium aligns with this. The EPSS score is low at 0.23% (13th percentile), indicating no statistical signal of imminent mass exploitation, and this is NOT on CISA KEV, so there is no public exploit identified at time of analysis. The main caveat: the description says the attacker can 'potentially read memory inside the sandbox,' which is a bounded information leak rather than a sandbox escape or RTC - on its own it is most valuable as one link in a larger exploit chain (e.g., paired with a sandbox-escape bug), not as a standalone critical. No conflicting signals were found; all sources agree this is a moderate, interaction-gated info-disclosure bug.

An attacker hosts or compromises a web page containing crafted HTML that triggers the memory-corruption condition in Chrome's Extensions component when a victim visits it. Because confidentiality impact is high but integrity and availability are not affected, the attacker's realistic goal is to read sensitive memory contents within the sandbox - for example to leak pointers or data useful for defeating ASLR in a follow-on exploit. No public exploit code has been identified at time of analysis, and successful attack requires the victim to actually load the malicious page (UI:R).