CVE-2026-120930
UnknownSummary
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium rates this as High severity.
Risk Assessment
An attacker can bypass the browser's origin policy, potentially leading to data leakage or unauthorized actions in the context of other sites. Browser users are exposed when visiting malicious pages.
Recommendation
Update Google Chrome to version 156.0.8078.47 or later. In corporate environments, enforce browser updates via management policies.
Other vulnerabilities in Google Chrome
See all- CVE-2026-121257Unknown
Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)
- CVE-2026-121256High
Use of a released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
- CVE-2026-121255Unknown
Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.
- CVE-2026-121254Unknown
Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page.
- CVE-2026-121253Unknown
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension.
- CVE-2026-121252Unknown
Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.
- CVE-2026-121251Unknown
Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.
- CVE-2026-121250Unknown
Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension.
- CVE-2026-121248Unknown
Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension.
- CVE-2026-121245Unknown
Race condition vulnerability in the Autofill component of Google Chrome prior to 157.0.8103.38. A remote attacker could potentially obtain sensitive information via a crafted HTML page.
Original NVD description (English source)
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS