Live › vulnerability › CVE-2026-113159
Go to dashboardImproper access control in DevTools in Google Chrome before 156.0.8078.47 lets a remote attacker leak sensitive information through a crafted HTML page. An attacker gets read access to data the browser should have kept from the page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any user or organization running Google Chrome before 156.0.8078.47 is exposed when they open a page an attacker controls. The flaw is in the browser itself, so the server-side stack and hosted applications are not the target. Teams that only use Chrome on fully updated devices, or that have no Chrome installs, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| google chrome | vendor | < 156.0.8078.47 | 156.0.8078.47 |
156.0.8078.47 to be fixed.156.0.8078.47.156.0.8078.47 or later, then relaunch the browser.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper access control in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-113159")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.