Description
Missing authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authorization bypass in Chrome renderer process
Action: Patch
AI Analysis

Impact

Missing authorization in the Actor component of Google Chrome before version 156.0.8078.47 enables a remote attacker who has already compromised the renderer process to bypass system access restrictions by delivering a specially crafted HTML page. The flaw is an authorization bypass (CWE-862) and does not provide direct code execution.

Affected Systems

The vulnerability applies to all Google Chrome releases earlier than 156.0.8078.47. Users running a browser build older than this patch are in a state of risk, regardless of operating system or deployment environment.

Risk and Exploitability

Chromium assigns a CVSS score of 6.5 and the EPSS score is below 1%. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to already have control over the renderer process; from that position the attacker can load a crafted HTML page to lift sandbox restrictions. The low EPSS and moderate CVSS indicate a low probability of widespread exploitation at this time.

Generated by OpenCVE AI on November 4, 2026 at 11:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 156.0.8078.47 or later.
  • Configure Chrome to automatically download and install security updates.
  • Restrict renderer process privileges via OS sandboxing or application containment to limit system access if upgrade cannot be applied promptly.

Generated by OpenCVE AI on November 4, 2026 at 11:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Wed, 04 Nov 2026 12:15:00 +0000

Type Values Removed Values Added
Title Authorization Bypass in Chrome Actor Component via Crafted HTML Page

Wed, 04 Nov 2026 02:45:00 +0000

Type Values Removed Values Added
Title Chrome Actor Memory Corruption Enables Remote Sandbox Memory Read via Crafted HTML

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low) Missing authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-862

Thu, 22 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Title Chrome Actor Memory Corruption Enables Remote Sandbox Memory Read via Crafted HTML

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-119
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:21:10.954Z

Reserved: 2026-10-19T23:16:09.245Z

Link: CVE-2026-113296

cve-icon Vulnrichment

Updated: 2026-10-21T15:09:53.867Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:19:23.717

Modified: 2026-11-03T22:19:07.450

Link: CVE-2026-113296

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T12:00:17Z

Weaknesses