CVE-2026-113075
High · 8.8CVSS
8.8
EPSS
0.3%
Published
Oct 20, 2026
CISA due date
—
The record
Origin validation error in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-120987 Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a… CWE-346
- CVE-2026-105769 kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure… CWE-346
- CVE-2026-74760 Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from… CWE-346
- CVE-2026-119331 Ladybird is a truly independent web browser. CWE-346
- CVE-2026-7005 WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request… CWE-346
- CVE-2026-119416 CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the… CWE-346
- CVE-2026-76026 Origin validation error in Autofill in Google Chrome prior to 156.0.8078.79 allowed a… CWE-346
- CVE-2026-119285 Fiber is an Express inspired web framework written in Go. CWE-346