CVE-2026-13848 is a use-after-free vulnerability in the Forms feature of Google Chrome. It affects versions before 150.0.7871.47 and enables remote code execution inside the sandbox via a specially crafted HTML page. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisory linked confirms the release of Chrome 150.0.7871.47 as the fix.

Successful exploitation allows remote attackers to execute arbitrary code within the sandboxed environment of the browser, potentially compromising confidentiality, integrity, and availability of the affected system. The attack requires user interaction but no privileges or complex conditions, making it a significant security risk.

Users should update Google Chrome to version 150.0.7871.47 or later, where this vulnerability is fixed. The vendor advisory confirms this version as the remediation. No additional mitigations are specified or required once the update is applied.