Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-113251: Chrome before 156.0.8078.47 may let malicious page bypass same-origin check

CVE-2026-113251 · published 15 days ago

Summary

Google Chrome (and Chromium on Debian) versions older than 156.0.8078.47 do not properly check data coming from PDF files, which could allow a specially crafted web page to get around the browser's same‑origin restrictions. This could let a remote attacker make the browser treat content from one site as if it came from another, potentially exposing data. Upgrade Chrome/Chromium to the latest version to close the gap.

What to do

Update debian chromium to version 156.0.8078.47-1~deb12u1.
Update debian chromium to version 156.0.8078.47-1~deb13u1.
Update debian chromium to version 156.0.8078.47-1.
Update google chrome to version 156.0.8078.47 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	google	chrome	< 156.0.8078.47
Debian:12	debian	chromium	< 156.0.8078.47-1~deb12u1 Fix: upgrade to 156.0.8078.47-1~deb12u1
Debian:13	debian	chromium	< 156.0.8078.47-1~deb13u1 Fix: upgrade to 156.0.8078.47-1~deb13u1
Debian:14	debian	chromium	< 156.0.8078.47-1 Fix: upgrade to 156.0.8078.47-1

Original advisory text

Improper input validation in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-416Use After Free

CWE-20Improper Input Validation

Timeline

Published20 Oct 2026

Updated4 Nov 2026

First seen20 Oct 2026

Sources

CVE-2026-113251 · NVD

CVE-2026-113251 · MITRE

DEBIAN-CVE-2026-113251 · OSV

Track software like this

Free during beta