Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-113290: Chrome before 156 bypasses site isolation
CVE-2026-113290 · published 15 days ago
Summary
Versions of Google Chrome and Debian Chromium older than 156.0.8078.47 can be tricked by a specially crafted web page to break the browser's site isolation protection. This could let an attacker who already controls part of the browser process access data from other sites. Updating Chrome/Chromium to version 156.0.8078.47 or later resolves the issue.
What to do
- Update debian chromium to version 156.0.8078.47-1~deb13u1.
- Update debian chromium to version 156.0.8078.47-1~deb12u1.
- Update debian chromium to version 156.0.8078.47-1.
- Update google chrome to version 156.0.8078.47 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | chromium |
< 156.0.8078.47-1~deb12u1 Fix: upgrade to 156.0.8078.47-1~deb12u1
|
| – | chrome |
< 156.0.8078.47 cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
|
| Debian:13 | debian | chromium |
< 156.0.8078.47-1~deb13u1 Fix: upgrade to 156.0.8078.47-1~deb13u1
|
| Debian:14 | debian | chromium |
< 156.0.8078.47-1 Fix: upgrade to 156.0.8078.47-1
|
Original advisory text
Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium...
Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.8
High
Type
CWE-416Use After Free
CWE-862Missing Authorization
Timeline
Published20 Oct 2026
Updated4 Nov 2026
First seen20 Oct 2026
Track software like this
Free during beta