CVE-2026-110160
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79. A remote attacker who had compromised the renderer process and leveraged social engineering could potentially bypass site isolation via a crafted HTML page. Severity: High.
Risk Assessment
An attacker could bypass site isolation, potentially leading to data leakage between different sites and increasing the risk of attacks on users.
Recommendation
Update Google Chrome to version 155.0.8059.79 or later to mitigate the vulnerability.
Other vulnerabilities in Google Chrome
See all- CVE-2026-121257Unknown
Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)
- CVE-2026-121256High
Use of a released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
- CVE-2026-121255Unknown
Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.
- CVE-2026-121254Unknown
Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page.
- CVE-2026-121253Unknown
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension.
- CVE-2026-121252Unknown
Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.
- CVE-2026-121251Unknown
Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.
- CVE-2026-121250Unknown
Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension.
- CVE-2026-121248Unknown
Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension.
- CVE-2026-121245Unknown
Race condition vulnerability in the Autofill component of Google Chrome prior to 157.0.8103.38. A remote attacker could potentially obtain sensitive information via a crafted HTML page.
Original NVD description (English source)
Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: High)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS