Live › vulnerability › CVE-2026-113129
Go to dashboardGoogle Chrome versions before 156.0.8078.47 have an improper access control flaw in Extensions. A remote attacker who lures a user to a crafted HTML page could potentially leak sensitive information.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any user running Google Chrome before 156.0.8078.47 is exposed, since the flaw is triggered by visiting a crafted HTML page. Organisations that manage browsers centrally should check fleet versions; the sources do not say whether specific extensions or configurations are required.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| google chrome | vendor | < 156.0.8078.47 | 156.0.8078.47 |
chrome://version in Chrome and compare the version to 156.0.8078.47156.0.8078.47 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper access control in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-113129")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.