Description
Missing authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Sandbox Escape
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a missing authorization flaw in the SiteIsolation component of Google Chrome prior to version 156.0.8078.47. It allows a remote attacker who has already compromised the renderer process to bypass the web origin policy via a crafted HTML page. The weakness corresponds to missing authorization (CWE‑862).

Affected Systems

Google Chrome browsers built before 156.0.8078.47 on all platforms where SiteIsolation is enabled. This includes any recent desktop or mobile installations that have not yet applied the stable‑channel update.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity. The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploitation yet. The likely attack vector is remote via a malicious or phishing website that serves a specially crafted HTML page, enabling the attacker to trigger the missing‑authorization flaw without any local user interaction beyond visiting the page.

Generated by OpenCVE AI on November 4, 2026 at 12:47 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome to version 156.0.8078.47 or newer as soon as possible
  • Limit exposure by avoiding opening unknown or suspicious HTML pages from untrusted sources on affected installations
  • Monitor for future security updates and apply them promptly

Generated by OpenCVE AI on November 4, 2026 at 12:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Wed, 04 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 04 Nov 2026 13:15:00 +0000

Type Values Removed Values Added
Title SiteIsolation Memory Corruption Enables Remote Sandbox Escape in Google Chrome

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Missing authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-862

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title SiteIsolation Memory Corruption Enables Remote Sandbox Escape in Google Chrome

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-119
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:20:34.527Z

Reserved: 2026-10-19T23:15:00.098Z

Link: CVE-2026-113281

cve-icon Vulnrichment

Updated: 2026-10-20T23:20:52.880Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:19:22.017

Modified: 2026-11-03T22:19:04.750

Link: CVE-2026-113281

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T13:00:16Z

Weaknesses