Google Chrome: Out-of-bounds write in Forms enables code execution outside sandbox

Summary

Google Chrome desktop versions before 156.0.8078.47 contain an out-of-bounds write in the Forms component (CWE-787). A remote attacker could potentially execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. NVD rates the issue CVSS 9.6 (Critical), while Google rates its own severity as Low; the attack requires user interaction (opening the page).

Affected

• Google Chrome desktop builds prior to 156.0.8078.47 (CNA description)
• The CNA affected-range entry in the official CVE record is inconsistent ("156.0.8078.47 to < 156.0.8078.47") and should be verified against the Google advisory.
• Microsoft Edge (Chromium-based): affected until updated; the fixed Edge build is unverified.
• Linux Chromium packages from distributions: depends on the distribution; Debian issued DSA 6577-1 and DLA 4853-1. Ubuntu lists chromium-browser as not affected because it ships as a Snap.

Fixed in

• Google Chrome 156.0.8078.47 or later (Linux: 156.0.8078.47; Windows and macOS: 156.0.8078.47 or .48 according to secondary sources, unverified)
• Newer Stable builds exist and are the practical target.
• Microsoft Edge: 156.0.4314.42 or later according to HKCERT (unverified, check MSRC).
• Debian: DSA 6577-1 and DLA 4853-1 for chromium (exact package versions unknown).

Workaround

• No workaround known. Update the browser.
• Chrome may keep running the old version until it is restarted; restart the browser after the update.

Exploitation

• CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
• No in-the-wild exploitation reported in the sources reviewed.
• Not listed in the CISA KEV catalog according to a GitHub vulnerability alert.
• No public proof of concept found.

Our recommendation

• Check the Chrome version on all endpoints, including Edge and Linux Chromium packages, and update to the current Stable build.
• Confirm that automatic updates work and that browsers have been restarted after the update.
• Check managed browser policies (Chrome Enterprise, Microsoft Intune) and verify the update status on all devices.
• Monitor for exploitation indicators and watch the vendor advisory for changes to the severity rating.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
• Chromium issue tracker issues.chromium.org
• Vulners CVE record CVE-2026-113300 vulners.com
• Ubuntu security CVE-2026-113300 ubuntu.com
• HKCERT security bulletin: Microsoft Edge multiple vulnerabilities www.hkcert.org
• Vulners MSRC record CVE-2026-113300 vulners.com
• OffSeq radar: CVE-2026-113300 radar.offseq.com
• Strix CVE-2026-113300 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:24.