Google Chrome CVE-2026-113300

Exploitation requires a victim using Google Chrome prior to 156.0.8078.47 to navigate to an attacker-controlled or compromised web page that serves a crafted HTML form designed to trigger the out-of-bounds write in the Forms component. No authentication is required (PR:N), but the attack is gated by mandatory user interaction (UI:R) - the victim must actively load the malicious page; there is no zero-click path. The primary limiting factors are the required user navigation and the fact that reaching 'outside the sandbox' depends on chaining past Chrome's renderer sandbox, which Google's 'Low' severity rating implies is not straightforward. Any patched Chrome build (156.0.8078.47 or later) fully removes exposure.

Signals conflict sharply here. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6 Critical) describes a remote, low-complexity, unauthenticated memory-corruption bug with a scope change consistent with the description's claim of code execution 'outside the sandbox' - on paper a top-tier threat. However, Google's own Chromium severity rating is explicitly 'Low', a direct and significant contradiction with the 9.6 score that should be treated as a red flag: the CVSS likely over-weights the theoretical 'outside the sandbox' wording ('potentially execute arbitrary code') while Google assesses practical exploitability as limited. No EPSS score was supplied, so exploitation probability cannot be quantified. The CVE is not in CISA KEV and no POC is referenced, so this is no public exploit identified at time of analysis - not active exploitation. Exploitation also requires user interaction (UI:R), lowering real-world weaponization likelihood versus a zero-click bug. Net: patch promptly because Chrome is ubiquitous and the fix is already shipped, but the vendor's 'Low' rating plus absence of EPSS/KEV/POC suggests this is a high-CVSS number that does not reflect confirmed high real-world risk. Verify the sandbox-escape claim against the Chrome release notes before escalating.

An attacker hosts or compromises a web page containing a crafted HTML form that triggers an out-of-bounds write in Chrome's Forms handling when a victim visits it. Because the description states the bug may allow code execution outside the sandbox, successful exploitation could run attacker code on the victim host rather than being confined to the renderer. No public exploit code is identified at time of analysis, and the attack requires the victim to load the malicious page (UI:R).