CVE-2026-113080
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted Chrome extension.
Risk Assessment
Spoofing the address bar may mislead users about the site they are visiting and facilitate phishing attacks.
Recommendation
Update Google Chrome to version 156.0.8078.47 or later.
Other vulnerabilities in Google Chrome
See all- CVE-2026-120930Unknown
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium rates this as High severity.
- CVE-2026-121257Unknown
Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)
- CVE-2026-121256High
Use of a released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
- CVE-2026-121255Unknown
Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.
- CVE-2026-121254Unknown
Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page.
- CVE-2026-121253Unknown
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension.
- CVE-2026-121252Unknown
Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.
- CVE-2026-121251Unknown
Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.
- CVE-2026-121250Unknown
Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension.
- CVE-2026-121248Unknown
Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension.
Original NVD description (English source)
UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted Chrome extension. (Chromium security severity: Low)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS