Google Chrome CVE-2026-113341

Exploitation requires a victim using Google Chrome on Android (versions prior to 156.0.8078.47) to actively open or navigate to an attacker-controlled HTML page that triggers the Skia memory-corruption path - this user-interaction requirement (UI:R) is the primary limiting factor. No authentication and no special or non-default browser configuration is needed (PR:N), and the affected Skia rendering engine is active in default browsing. The impact is further LIMITED to reading memory within the renderer sandbox: it does not by itself grant sandbox escape, code execution, or data modification, so a successful attack yields information disclosure rather than full device compromise.

Signals are consistent and point to a moderate, not top-tier, priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction and yields only a confidentiality impact - specifically an out-of-bounds memory READ confined inside the renderer sandbox, with no integrity or availability impact. This aligns with the description ('potentially read memory inside the sandbox'), so this is an information-disclosure primitive, not direct code execution. Note the divergence worth flagging: Chromium labels the issue 'Critical' severity while the CVSS base score is only 6.5 (Medium) - the vendor's rating reflects memory-safety class/upstream risk, whereas the CVSS reflects the constrained sandbox-read impact; treat the CVSS impact framing as the operational reality. EPSS is low at 0.24% (14th percentile), the CVE is NOT on CISA KEV, and no public exploit was identified, so there is no evidence of active or imminent widespread exploitation. The mitigating factor of required user interaction (UI:R) further lowers real-world urgency. Given Chrome's ubiquity, patch promptly through normal update cycles, but this does not warrant emergency out-of-band response on the available data.

An attacker hosts a crafted HTML page that drives Chrome's Skia graphics library into a memory-corruption condition when rendered on an Android device. A victim who is lured to the page triggers an out-of-bounds read, letting the attacker leak memory contents from within the renderer sandbox (e.g., to defeat ASLR or harvest sensitive in-process data). No public exploit code was identified at time of analysis.