Google Chrome CVE-2026-113335

Exploitation requires the victim to actively load attacker-controlled content - the CVSS vector specifies UI:R (user interaction), so the user must visit or render a crafted HTML page in a vulnerable Chrome build before 156.0.8078.47; it is not a no-interaction drive-by against a server. No authentication or prior privilege is needed (PR:N). The primary limiting factor is that code execution is confined to the browser sandbox (per the description), so a standalone exploit cannot reach the underlying OS without being chained to an additional sandbox-escape vulnerability; scope is unchanged (S:U). Any Chrome desktop installation at a version below the fixed build in a default configuration is affected - no special feature or non-default setting is required to be vulnerable.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated memory-corruption flaw requiring only that a victim load a crafted HTML page. However, a key signal conflicts: Google rates the Chromium security severity as Medium, and the description explicitly states code execution occurs INSIDE the sandbox - meaning the flaw alone does not achieve a full host compromise without a separate sandbox-escape, which tempers the 8.8 score. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no POC/exploit code is referenced, so there is no evidence of active or public exploitation. Net assessment: patch promptly given Chrome's ubiquity and the low attack complexity, but the sandboxed-execution limitation and Google's Medium rating suggest this is a real-but-not-emergency priority rather than a high-CVSS issue with confirmed mass exploitation. EPSS and real-world exploitation data are missing and should be monitored.

An attacker hosts or compromises a web page containing crafted HTML that triggers the memory-corruption bug in Chrome's Extensions component when a victim visits it with a vulnerable browser (prior to 156.0.8078.47). Successful exploitation yields arbitrary code execution confined to the renderer/extensions sandbox, which would typically need to be chained with a separate sandbox escape to fully compromise the host. No public proof-of-concept or exploit code is identified at time of analysis.