Description
Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-10-30
Score: n/a
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Improper input validation in the CacheStorage API inside Google Chrome allows a remote attacker to execute arbitrary code within the browser sandbox by loading a specially crafted HTML page. The flaw, identified in versions before 156.0.8078.79, can lead to code execution in the context of the user’s profile, potentially compromising confidential data or allowing further system compromise.

Affected Systems

The vulnerability affects Google Chrome across all platforms for versions earlier than 156.0.8078.79. Users on those versions are susceptible; updates beyond this version introduce a fix.

Risk and Exploitability

The flaw carries a high severity rating, and although EPSS data is not available and the vulnerability is not listed in CISA's KEV catalog, the risk remains significant. Attackers can leverage a remote vector by instructing a victim to visit a malicious web page that exploits CacheStorage. No special credentials or local presence are required beyond the browser session, and the exploit does not depend on additional system configuration.

Generated by OpenCVE AI on October 30, 2026 at 01:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Chrome 156.0.8078.79 or later to apply the vendor‑released fix.
  • If an immediate update is not possible, disable CacheStorage or block the feature via group policy or site‑wide settings until a patch can be applied.
  • Avoid accessing untrusted or unknown websites and educate users about the risks associated with visiting potentially malicious pages while Chrome is out of date.

Generated by OpenCVE AI on October 30, 2026 at 01:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 02:15:00 +0000

Type Values Removed Values Added
Title Improper Input Validation in CacheStorage Allows Remote Code Execution

Fri, 30 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 30 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-20
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-30T00:05:10.072Z

Reserved: 2026-10-29T18:29:20.654Z

Link: CVE-2026-119270

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-30T01:16:45.937

Modified: 2026-10-30T01:16:46.030

Link: CVE-2026-119270

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T02:00:08Z

Weaknesses
  • CWE-20

    Improper Input Validation