EIP-2026-103479

This PoC exploits a type confusion vulnerability in Chrome's HTMLKeygenElement by manipulating the userAgentShadowRoot via caretRangeFromPoint(), leading to a blind cast of an incorrect node type to HTMLSelectElement. The exploit demonstrates arbitrary DOM manipulation within the shadow tree, potentially leading to further exploitation.