CVE-2026-113300

Summary

An out-of-bounds write in Chrome's Forms component allows a remote attacker to corrupt memory when a victim visits a malicious HTML page, potentially leading to arbitrary code execution outside the sandbox.

Exploitability

Exploitation requires social engineering (e.g.,诱使用户访问 a crafted page) due to the UI:R vector and is non-trivial given Chrome’s sandbox, though the low severity rating suggests limited exploit complexity.

Blast radius

Successful exploitation could lead to full system compromise via sandbox escape, affecting any user who visits the malicious page while Chrome remains unpatched.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Google Chrome to version 156.0.8078.47 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.