Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Chrome before 156.0.8078.47 lets compromised page gain extra access

CVE-2026-113151 · published 15 days ago
Summary

Versions of Google Chrome and Chromium on Debian older than 156.0.8078.47 can let a malicious web page escape the normal limits that keep it from reaching the rest of the system. If an attacker already controls the part of Chrome that renders web pages, they could use a specially crafted page to break those limits. Updating Chrome/Chromium to the latest version removes the problem.

What to do
  • Update debian chromium to version 156.0.8078.47-1~deb13u1.
  • Update debian chromium to version 156.0.8078.47-1~deb12u1.
  • Update debian chromium to version 156.0.8078.47-1.
  • Update google chrome to version 156.0.8078.47 or later.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian chromium < 156.0.8078.47-1~deb12u1
Fix: upgrade to 156.0.8078.47-1~deb12u1
– google chrome < 156.0.8078.47
Debian:13 debian chromium < 156.0.8078.47-1~deb13u1
Fix: upgrade to 156.0.8078.47-1~deb13u1
Debian:14 debian chromium < 156.0.8078.47-1
Fix: upgrade to 156.0.8078.47-1
Original advisory text
Missing authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML pag...
Missing authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
CWE-862Missing Authorization
Timeline
Published20 Oct 2026
Updated4 Nov 2026
First seen20 Oct 2026
Sources
CVE-2026-113151 · NVD
DEBIAN-CVE-2026-113151 · OSV
CVE-2026-113151 · MITRE
Track software like this
Free during beta