AI and data stack advisories

Severe, 6 weeks1490Projects326

1490 severe, 6 weeks · 326 projects

GoogleCVE-2026-113126

Google Chrome: remote attacker could bypass web origin policy into

Google

CVE-2026-113126 · Published Oct 20, 2026 · updated Nov 3, 2026

Critical9.6
Fix: upgrade to 156.0.8078.47 or later
Google advisory

Improper resource exposure in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

Affected versions

PackageAffectedFixed in
Chrome
Product
>= 156.0.8078.47, < 156.0.8078.47156.0.8078.47
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Severity from
CISA (its enrichment of the CVE record)
Weakness
CWE-668

More Google advisories

All Google
High 8.8Oct 20Google Chrome: improper authorizationCVE-2026-113343fixed in 156.0.8078.47High 8.8Oct 20Google Chrome: local attacker could read memoryCVE-2026-113344fixed in 156.0.8078.47High 8.8Oct 20Google Chrome: race conditionCVE-2026-113335fixed in 156.0.8078.47Critical 9.6Oct 20Google Chrome: use after freeCVE-2026-113336fixed in 156.0.8078.47High 8.8Oct 20Google Chrome: use after freeCVE-2026-113337fixed in 156.0.8078.47High 8.8Oct 20Google Chrome: use after freeCVE-2026-113339fixed in 156.0.8078.47