Description
Incorrect calculation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-10-20
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Permission Bypass
Action: Patch
AI Analysis

Impact

An incorrect calculation in Chrome’s Permissions module before 156.0.8078.47 enables a remote attacker to use a crafted HTML page to bypass the browser’s system access restrictions. This is a classic case of Improper Restriction of Operations Inside a Privileged Environment (CWE‑682).

Affected Systems

Google Chrome browsers on any platform running a version earlier than 156.0.8078.47, including the stable channel releases referenced in the advisory.

Risk and Exploitability

The CVSS score of 9.6 indicates a high severity, and the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit it remotely by loading a malicious web page; successful exploitation bypasses the browser’s system access restrictions and can lead to elevated privileges within the browser context.

Generated by OpenCVE AI on November 4, 2026 at 06:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome to version 156.0.8078.47 or newer.
  • Ensure automatic updates are enabled so that future fixes are applied promptly.
  • Restrict or block loading of untrusted HTML pages from untrusted sources to reduce exposure.

Generated by OpenCVE AI on November 4, 2026 at 06:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Wed, 04 Nov 2026 07:15:00 +0000

Type Values Removed Values Added
Title Chrome Permissions Miscalculation Allows Remote Attacker to Bypass System Access

Wed, 04 Nov 2026 03:15:00 +0000

Type Values Removed Values Added
Title Memory Corruption in Chrome Permissions Enables Remote Code Execution

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Incorrect calculation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-682

Thu, 22 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Title Memory Corruption in Chrome Permissions Enables Remote Code Execution

Wed, 21 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome

Wed, 21 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-119
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:20:57.108Z

Reserved: 2026-10-19T22:49:35.771Z

Link: CVE-2026-113007

cve-icon Vulnrichment

Updated: 2026-10-21T00:44:41.895Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:18:51.210

Modified: 2026-11-03T22:17:50.667

Link: CVE-2026-113007

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T07:00:14Z

Weaknesses