How to read the conflicting impact claims for CVE-2026-113106
StarkManHow to read the conflicting impact claims for CVE-2026-113106
How to read the conflicting impact claims for CVE-2026-113106
CVE-2026-113106 has more than one described outcome in circulation. The current Chrome CNA record says a Skia type confusion can let an attacker who has compromised the renderer obtain cross-origin data through crafted HTML. Some older summaries describe arbitrary code execution inside the sandbox.
The current record should control the technical description, while the discrepancy should remain visible. Chrome before 156.0.8078.47 is affected. The vendor assigns a Chromium security severity of Medium. CISA's enriched record assigns CVSS 3.1 a base score of 8.8 and records exploitation as none and automatable as no.
What changed in the record
The CVE record is a versioned disclosure object produced by the Chrome CNA. Its current description names CWE-843 and cross-origin data exposure. It also states the renderer prerequisite. The public Skia commit supports the presence of a SmallPathAtlas collision fix, but it does not describe arbitrary code execution.
Older text can remain in mirrors, scanners, and secondary feeds after the primary record changes. A security team should retrieve the current CNA record or a current authoritative mirror and note the date checked. A copied sentence from a vendor bulletin is not enough when the primary description has changed.
The patch evidence
The Skia commit says carefully constructed draws could cause SDF and Bitmap entries to collide in Ganesh's SmallPathAtlas. It calls the consequence a potential data leak. The patch adds a data tag so the cache can distinguish the entry types. It includes a test change.
This evidence supports a cache correctness and data-exposure interpretation. It does not give a complete proof of code execution, sandbox escape, or exploitation in the wild. The Chromium issue is restricted, which prevents independent review of the trigger.
The scoring evidence
Chromium's Medium label and CISA's CVSS 8.8 answer different questions. The vendor severity reflects Chromium's assessment of the security issue. CVSS models the possible impact under a standard vector. The vector lists network attack, low complexity, no privileges, user interaction, high confidentiality, high integrity, and high availability.
Those values can coexist with a Medium vendor label. They also do not prove exploitation. SSVC separately says exploitation is not observed and the flaw is not automatable. That assessment may change over time, so it should be timestamped.
Affected product scope
The CNA lists Google Chrome before 156.0.8078.47. The stable release post covers Windows, Mac, and Linux. Its listed builds are 156.0.8078.47 for Linux and 156.0.8078.47/.48 for Windows and Mac.
The record does not supply a universal range for every Chromium-based browser. A vendor that ships its own build should publish its own affected versions. Operations should verify the actual product and exact build, not infer fixed status from a shared major version.
Exposure evidence
ZoomEye's product="Chrome" search returned 825 matches. The CVE filter returned zero. Exposure is the larger successful count, 825.
The count is a broad product fingerprint result. It does not establish the affected range, the renderer precondition, or exploitation. The zero filter also does not prove that no affected systems exist. Both observations should be retained with their query time and scope.
A defensible report
A concise report can say: Chrome before 156.0.8078.47 is affected by a Skia type confusion; the current CNA record requires renderer compromise and describes cross-origin data exposure; Chromium rates it Medium while CISA enrichs it to CVSS 8.8; the exact trigger is restricted; ZoomEye finds 825 broad Chrome fingerprints but no CVE-specific matches; updating to the fixed build is required.
That report preserves the facts that matter and leaves out unsupported conclusions. It does not claim that the older arbitrary-code statements are false in every possible exploit chain. It says the current primary description does not establish them.
Remediation
Update to the fixed Chrome build for each platform and verify the version. Review renderer compromise telemetry on high-value endpoints. If a public report claims code execution, trace the claim back to its source and compare it with the current CVE record before using it in an incident decision.
No vendor workaround is stated in the selected record. Patching remains the control that removes the known flaw.