How to read the conflicting impact claims for CVE-2026-113106

CVE-2026-113106 has more than one described outcome in circulation. The current Chrome CNA record says a Skia type confusion can let an attacker who has compromised the renderer obtain cross-origin data through crafted HTML. Some older summaries describe arbitrary code execution inside the sandbox.

The current record should control the technical description, while the discrepancy should remain visible. Chrome before 156.0.8078.47 is affected. The vendor assigns a Chromium security severity of Medium. CISA's enriched record assigns CVSS 3.1 a base score of 8.8 and records exploitation as none and automatable as no.

What changed in the record

The CVE record is a versioned disclosure object produced by the Chrome CNA. Its current description names CWE-843 and cross-origin data exposure. It also states the renderer prerequisite.…