{"id":"CVE-2026-113300","kind":"vulnerability","aliases":["CVE-2026-113300"],"related":[],"title":"Chrome: out-of-bounds write in Forms lets a web page run code","description":"Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","summary":"A crafted HTML page can trigger an out-of-bounds write in Chrome's Forms component, which can let a remote attacker execute arbitrary code outside the browser sandbox. The source reports a CVSS score of 9.6 (critical), while Chromium rates its own severity as Low.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"google chrome","fixed":["156.0.8078.47"],"affected":"< 156.0.8078.47","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browser","chrome","linux","macos","other","package","windows"],"not_affected_if":["chrome-already-updated"],"how_to_check":"Run chrome://version in Chrome and check whether the version is below 156.0.8078.47.\nOn managed machines, check the installed Chrome version with the platform's software inventory tool.","fix":"Update Google Chrome to 156.0.8078.47 or later and restart the browser.","status":"open","published_at":"2026-10-20T22:19:24+00:00","first_seen_at":"2026-10-23T21:57:24+00:00","triaged_at":"2026-10-23T22:35:16+00:00","updated_at":"2026-10-23T22:35:16+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:35:16Z","model":"claude-haiku-5-5","output":{"fix":"Update Google Chrome to 156.0.8078.47 or later and restart the browser.","reach":"internet","title":"Chrome: out-of-bounds write in Forms lets a web page run code","impact":"high","summary":"A crafted HTML page can trigger an out-of-bounds write in Chrome's Forms component, which can let a remote attacker execute arbitrary code outside the browser sandbox. The source reports a CVSS score of 9.6 (critical), while Chromium rates its own severity as Low.","category":"package","who_cares":["chrome","windows","macos","linux"],"confidence":0.8,"needs_auth":"no","worst_case":"Arbitrary code runs outside the sandbox after a user visits a page.","analyst_note":"","how_to_check":"Run chrome://version in Chrome and check whether the version is below 156.0.8078.47.\nOn managed machines, check the installed Chrome version with the platform's software inventory tool.","needs_analyst":false,"not_affected_if":["chrome-already-updated"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.00049,"input_tokens":2948,"output_tokens":391,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-113300':17A,20A '-2026':16A,19A '156.0.8078.47':88C '9.6':67B 'allow':89C 'arbitrari':54B,96C 'attack':52B,92C 'bound':5A,40B,79C 'browser':23B,58B 'chrome':1A,22A,24B,43B,85C 'chromium':70B,106C 'code':14A,55B,97C 'compon':46B 'craft':31B,103C 'critic':68B 'cve':15A,18A 'cvss':64B 'execut':53B,95C 'form':8A,45B,82C 'googl':84C 'google':21A 'html':32B,104C 'let':9A,49B 'linux':25B 'low':76B,109C 'maco':26B 'out-of-bound':2A,37B 'outsid':56B,98C 'packag':28B 'page':12A,33B,105C 'potenti':94C 'prior':86C 'rate':71B 'remot':51B,91C 'report':62B 'run':13A 'sandbox':59B,100C 'score':65B 'secur':107C 'sever':74B,108C 'sourc':61B 'trigger':35B 'via':101C 'web':11A 'window':29B 'write':6A,41B,80C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113300","severity":null,"published_at":"2026-10-20T22:19:24+00:00","modified_at":"2026-10-22T23:18:29+00:00","first_seen_at":"2026-10-23T21:57:24+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}