CVE-2026-113300 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome deployments, especially in environments exposed to untrusted web content, should assess and mitigate this vulnerability. They should prioritize verifying and applying the update to ensure the secure version of Chrome is deployed. Defenders should also review and restrict exposure of Chrome to untrusted web content and monitor for any suspicious activity related to crafted HTML pages.

Why it matters

CVE-2026-113300 is an out-of-bounds write vulnerability in Google Chrome's Forms component that could allow remote code execution outside the sandbox. Defenders should prioritize updating Chrome to version 156.0.8078.47 or later and restrict exposure to untrusted web content.

• Potential remote code execution outside the sandbox
• Exposure to crafted HTML pages could lead to security bypass
• Verification of Chrome version and update deployment are crucial
• Restricting exposure to untrusted web content is recommended

Technical summary

The vulnerability is an out-of-bounds write issue in the Forms component of Google Chrome prior to version 156.0.8078.47. This could potentially allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. The issue was reported through the Chromium security severity process and was addressed in Chrome version 156.0.8078.47. Defenders should prioritize verifying and applying the update to ensure the secure version of Chrome is deployed, focusing on systems and users exposed to untrusted web content.

Defensive priority

Defenders should prioritize verifying and applying the update to ensure the secure version of Chrome is deployed, focusing on systems and users exposed to untrusted web content.

Recommended defensive actions

• Verify and apply the Chrome update to version 156.0.8078.47 or later
• Review and restrict exposure of Chrome to untrusted web content
• Monitor for any suspicious activity related to crafted HTML pages
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and affected versions. Chromium security severity is listed as Low. The vulnerability was reported through the Chromium security severity process and addressed in Chrome version 156.0.8078.47. There is no evidence of exploitation in the wild. The CVE Program record and NIST NVD detail page provide additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.