CVE-2026-113050
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Oct 20, 2026
CISA due date
—
The record
Incomplete cleanup in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121204 Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-459
- CVE-2026-121096 Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker… CWE-459
- CVE-2026-121055 Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-459
- CVE-2026-85033 The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent… CWE-459
- CVE-2026-116132 HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete… CWE-459
- CVE-2026-115478 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. CWE-459
- CVE-2026-113168 Incomplete cleanup in Permissions in Google Chrome prior to 156.0.8078.47 allowed a… CWE-459
- CVE-2026-113073 Incomplete cleanup in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote… CWE-459