{"id":"CVE-2026-126875","kind":"vulnerability","aliases":["CVE-2026-126875"],"related":[],"title":"Chrome: V8 flaw lets crafted web page bypass origin policy","description":"Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)","summary":"A missing authorization check in V8, Chrome's JavaScript engine, lets a crafted HTML page bypass web origin policy. An attacker who lures a user to that page can read or act on content from other sites.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","desktop","mobile","other"],"not_affected_if":["chrome-updated"],"how_to_check":"- Open Chrome and check the version under Settings > About Chrome; the version string is shown there.\n- Compare it against `157.0.8103.78`; anything older is listed as prior to the fix.","fix":"- Google Chrome: update to `157.0.8103.78` or later.","status":"open","published_at":"2026-11-11T23:17:16+00:00","first_seen_at":"2026-11-11T23:29:38+00:00","triaged_at":"2026-11-11T23:32:17+00:00","updated_at":"2026-11-11T23:32:17+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-11T23:32:17Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: update to `157.0.8103.78` or later.","reach":"internet","title":"Chrome: V8 flaw lets crafted web page bypass origin policy","impact":"medium","summary":"A missing authorization check in V8, Chrome's JavaScript engine, lets a crafted HTML page bypass web origin policy. An attacker who lures a user to that page can read or act on content from other sites.","audience":"everyone","category":"other","nicknames":[],"who_cares":["chrome","browser","desktop","mobile"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads or acts on data from other websites in the victim's browser","analyst_note":"","how_to_check":"- Open Chrome and check the version under Settings > About Chrome; the version string is shown there.\n- Compare it against `157.0.8103.78`; anything older is listed as prior to the fix.","plain_action":"Update Google Chrome to version 157.0.8103.78 or later: Settings > About Chrome.","product_name":"","needs_analyst":false,"not_affected_if":["chrome-updated"],"who_is_affected":"Anyone running Google Chrome before 157.0.8103.78 is exposed when they visit a page an attacker controls. Exposure is through the browser itself, so servers and non-Chrome browsers are not in scope. unknown for any finer detail on configuration.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4524,"output_tokens":517,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126875':13A,16A '-2026':12A,15A '157.0.8103.78':67C 'act':52B 'allow':68C 'attack':41B,71C 'author':23B,59C 'browser':17B 'bypass':8A,36B,73C 'check':24B 'chrome':1A,18B,27B,64C 'chromium':82C 'content':54B 'craft':5A,33B,79C 'cve':11A,14A 'desktop':19B 'engin':30B 'flaw':3A 'googl':63C 'high':85C 'html':34B,80C 'javascript':29B 'let':4A,31B 'lure':43B 'miss':22B,58C 'mobil':20B 'origin':9A,38B,75C 'page':7A,35B,48B,81C 'polici':10A,39B,76C 'prior':65C 'read':50B 'remot':70C 'secur':83C 'sever':84C 'site':57B 'user':45B 'v8':2A,26B,61C 'via':77C 'web':6A,37B,74C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Google Chrome before 157.0.8103.78 is exposed when they visit a page an attacker controls. Exposure is through the browser itself, so servers and non-Chrome browsers are not in scope. unknown for any finer detail on configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.78 or later: Settings > About Chrome.","pkeys":[],"ptokens":[],"labels":["browser","chrome","desktop","high","mobile","other"],"campaign_type":null,"search_a":"'-126875':13A,16A '-2026':12A,15A 'bypass':8A 'chrome':1A 'craft':5A 'cve':11A,14A 'flaw':3A 'let':4A 'origin':9A 'page':7A 'polici':10A 'v8':2A 'web':6A","search_b":"'act':52B 'attack':41B 'author':23B 'browser':17B 'bypass':36B 'check':24B 'chrome':18B,27B 'content':54B 'craft':33B 'desktop':19B 'engin':30B 'html':34B 'javascript':29B 'let':31B 'lure':43B 'miss':22B 'mobil':20B 'origin':38B 'page':35B,48B 'polici':39B 'read':50B 'site':57B 'user':45B 'v8':26B 'web':37B","search_c":"'157.0.8103.78':67C 'allow':68C 'attack':71C 'author':59C 'bypass':73C 'chrome':64C 'chromium':82C 'craft':79C 'googl':63C 'high':85C 'html':80C 'miss':58C 'origin':75C 'page':81C 'polici':76C 'prior':65C 'remot':70C 'secur':83C 'sever':84C 'v8':61C 'via':77C 'web':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T23:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126875","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126875","severity":null,"published_at":"2026-11-11T23:17:16+00:00","modified_at":"2026-11-11T23:17:16+00:00","first_seen_at":"2026-11-11T23:29:38+00:00","fetched_at":"2026-11-11T23:29:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}