Vulnerability · Google Chrome
CVE-2026-118337
Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
CVSS score (v3.1)9.3Critical
Fixed in 156.0.8078.73
Not on CISA KEV list
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
Show me how to fix itTimeline
- Published by NVD
- First covered by RedTeamDaily
- Last updated by NVD
Affected products
| Product | Versions |
|---|---|
| Google Chrome | up to before 156.0.8078.73 |
Coverage
Google releases Chrome 156 stable security update fixing 52 flaws, including critical bugs
Chrome Stable 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux addresses 52 security issues, several rated critical, including CVE-2026-118331 in FileAPI and CVE-2026-118306 in FileSystem. ChromeOS 16836.30.0 (Browser 156.0.8078.77) is rolling out to Stable devices with its own list of fixes, and Beta and Dev channels have also received ChromeOS 157 builds.
Sources: NVD and CISA known exploited vulnerabilities catalogue.