CVE-2026-113168 reports an incomplete cleanup in the Permissions component of Google Chrome before version 156.0.8078.47. A remote attacker can leverage social engineering to craft an HTML page that, when opened by a user, bypasses system access restrictions by taking advantage of residual permission data left on the system. The flaw is classified as CWE‑459 and has a CVSS score of 8.8.

Google Chrome browsers of any desktop platform running a version earlier than 156.0.8078.47 are vulnerable. The flaw resides in the Permissions module, which is part of all standard Chrome installations that process web content.

EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting that active exploitation is low. The likely attack vector is a maliciously crafted HTML page opened by the victim without prior compromise. The description indicates the attacker can bypass system access controls, but the extent of privileges gained or whether code execution outside the browser sandbox occurs is not specified in the advisory.