Description
Confused deputy in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Web Origin Policy Bypass
Action: Immediate Patch
AI Analysis

Impact

This vulnerability is a confused deputy flaw in Google Chrome versions earlier than 156.0.8078.47. A remote attacker can craft an HTML page that, when rendered by the browser, bypasses the standard web origin policy and gains access to privileged pages normally protected from other origins. The flaw allows attackers to read or modify sensitive content, undermining Chrome’s isolation guarantees. The weakness is categorized as CWE‑441.

Affected Systems

Affected installations are all users running Google Chrome version prior to 156.0.8078.47 on Windows, macOS, Linux, and other supported platforms. Chrome releases older than 156.0.8078.47 are susceptible to this vulnerability.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity level. Because the attack vector is network‑based via a crafted web page, the likelihood of exploitation remains uncertain due to the EPSS score of less than 1%, and the vulnerability is not currently listed in the CISA KEV catalog. The web origin policy bypass grants attackers privileged access to content normally protected, posing a significant risk to confidentiality and integrity.

Generated by OpenCVE AI on November 4, 2026 at 12:31 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Chrome update (156.0.8078.47 or newer), released in the October 2026 stable channel update.
  • Avoid loading or interacting with untrusted or unknown HTML content that could contain crafted payloads.
  • If an update cannot be deployed immediately, enforce additional enterprise‑level sandboxing or content filtering policies to limit access to potentially malicious web content.

Generated by OpenCVE AI on November 4, 2026 at 12:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Wed, 04 Nov 2026 13:00:00 +0000

Type Values Removed Values Added
Title Browser Memory Corruption Exploitable via Crafted HTML in Google Chrome

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Confused deputy in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-441

Thu, 22 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Title Browser Memory Corruption Exploitable via Crafted HTML in Google Chrome

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-119
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:20:37.920Z

Reserved: 2026-10-19T23:01:07.958Z

Link: CVE-2026-113127

cve-icon Vulnrichment

Updated: 2026-10-20T23:18:19.699Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:19:04.880

Modified: 2026-11-03T22:18:36.540

Link: CVE-2026-113127

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T12:45:14Z

Weaknesses
  • CWE-441

    Unintended Proxy or Intermediary ('Confused Deputy')