Live › vulnerability › CVE-2026-118337
Go to dashboardA flaw in the Forms component of Google Chrome before 156.0.8078.73 lets a remote attacker bypass the web origin policy using a crafted HTML page. The sources describe the bypass only in general terms, so the exact data an attacker can reach is unknown.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 23:29 UTC. All times on this page are UTC.
Anyone running Google Chrome before 156.0.8078.73 on a desktop where a user can visit a web page, including managed fleets that delay browser updates. Browsers already on or later are not affected. The sources do not say whether any particular Chrome configuration changes exposure.
156.0.8078.73No product ranges from the sources yet.
156.0.8078.73156.0.8078.73 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-118337")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.