Cross-origin data is valuable because browsers use origin boundaries to keep one site from reading another site's resources. CVE-2026-113106 is relevant to that boundary after a renderer compromise. Chrome's current CVE record says the Skia type confusion can expose cross-origin data through a crafted HTML page, but only for an attacker who already controls the renderer.
The flaw affects Google Chrome before 156.0.8078.47. Chromium rates it Medium, while CISA's enriched record assigns CVSS 3.1 a base score of 8.8. Those scores need to be read alongside the renderer precondition and the absence of observed exploitation.
What enters the origin boundary
A browser profile can reach many authenticated resources. An attacker with renderer control may already see the content of the page under control and may manipulate requests from that context. Cross-origin restrictions prevent arbitrary reads into other origins. A graphics-side data leak can help an attacker move beyond that limit if the renderer can capture or infer data from another site's drawing state.
The public Skia commit describes the mechanism indirectly. SDF and Bitmap entries in Ganesh's SmallPathAtlas could collide, potentially exposing data. The fix tags entries to keep the representations separate. It does not publish the exact page or draw sequence that produces a useful cross-origin result.
This is why the finding should be classified as a potential data-exposure primitive. It is not a generic web-page data collector. The attacker must already be in a position to shape renderer work and read the resulting signal.
Business impact
The highest concern is data that the browser can access under the user's authenticated sessions. That may include internal applications, account pages, or documents rendered in the browser. The actual value depends on the victim, the page, the browser profile, and what the attacker can do with the renderer foothold.
The CVSS vector lists high confidentiality, integrity, and availability impact. The CNA text is narrower and emphasizes data exposure. Security reports should preserve both facts without claiming that the scored impacts were observed. If the organization needs an impact rating, state the model used and the evidence behind it.
Affected platforms and builds
The affected range in the CVE record is Chrome before 156.0.8078.47. Google's Chrome 156 stable release covers Windows, Mac, and Linux. It lists 156.0.8078.47 for Linux and 156.0.8078.47/.48 for Windows and Mac.
Managed browsers can lag behind stable, and user-installed browsers can sit outside official inventory. Both need exact build checks. Chromium-based products require their own vendor confirmation because the CVE record's affected product is Google Chrome.
Exposure and evidence quality
ZoomEye returned 825 product-fingerprint matches for product="Chrome" and zero for the CVE filter. Exposure uses 825. The product count does not establish vulnerable versions or renderer compromise.
The zero filter is also not a clean bill of health. It may reflect incomplete CVE indexing or the absence of enough asset evidence. The successful product query and successful filter query describe different observations, and neither replaces endpoint inventory.
Defensive controls
Update Chrome to the fixed build and verify the exact version. For users with access to sensitive internal sites, add controls that shorten the useful life of a renderer compromise: restrict untrusted extensions, monitor unexpected cross-origin activity, and investigate renderer crashes with security telemetry.
Network controls cannot see every cross-origin read inside a browser. Endpoint telemetry and application audit logs may be more useful. Look for unusual access from a browser session to resources that the user did not intentionally open, especially around suspicious page visits or browser process anomalies.
Handling an investigation
If a renderer compromise is suspected, preserve browser version data, extension state, crash reports, process events, and relevant web proxy logs. Keep the CVE assessment separate from the initial-compromise investigation. The restricted Chromium issue means the public information cannot guide a full reproduction.
Patch first, then investigate. Do not wait for evidence of exploitation to update. SSVC's current exploitation value of none is a snapshot, not a permanent claim.