CVE-2026-126896

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126896", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "state": "PUBLISHED", "assignerShortName": "Chrome", "dateReserved": "2026-11-11T22:10:29.259Z", "datePublished": "2026-11-11T22:38:55.392Z", "dateUpdated": "2026-11-12T17:47:44.325Z"}, "containers": {"cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"version": "157.0.8103.78", "status": "affected", "lessThan": "157.0.8103.78", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing authorization", "cweId": "CWE-862"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2026-11-11T22:38:55.392Z"}, "references": [{"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"}, {"url": "https://issues.chromium.org/issues/575524702"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T17:47:41.330854Z", "id": "CVE-2026-126896", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T17:47:44.325Z"}}]}}

{}

{"affected": [{"affectedData": [{"product": "Chrome", "vendor": "Google", "versions": [{"lessThan": "157.0.8103.78", "status": "affected", "version": "157.0.8103.78", "versionType": "custom"}]}], "source": "chrome-cve-admin@google.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}], "id": "CVE-2026-126896", "lastModified": "2026-11-12T18:17:36.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-126896", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T17:47:41.330854Z", "version": "2.0.3"}}]}, "published": "2026-11-11T23:17:19.170", "references": [{"source": "chrome-cve-admin@google.com", "url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"}, {"source": "chrome-cve-admin@google.com", "url": "https://issues.chromium.org/issues/575524702"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "chrome-cve-admin@google.com", "type": "Secondary"}]}

{"bugzilla": {"description": "chromium-browser: chromium-browser: Web origin policy bypass via crafted HTML page", "id": "2571993", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571993"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-346", "details": ["A flaw was found in the V8 engine in chromium-browser. Due to missing authorization checks, a remote attacker can bypass web origin policy restrictions by tricking a user into loading a specially crafted HTML page. Successful exploitation could allow the attacker to access or manipulate sensitive data belonging to other websites within the user's browser session."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-126896", "public_date": "2026-11-11T22:38:55Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-126896\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-126896\nhttps://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html\nhttps://issues.chromium.org/issues/575524702"], "statement": "This vulnerability is rated as Important because successful exploitation allows a remote attacker to circumvent same-origin policy boundaries, potentially exposing or modifying sensitive session information across different web contexts. In standard Red Hat Enterprise Linux workstation deployments where Chromium is utilized, exploitation necessitates that a user actively visits a malicious or compromised web page. Despite the requirement for user interaction, the ability to breach domain isolation without requiring elevated privileges poses a substantial risk to user data confidentiality and integrity.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[157.0.8103.78,157.0.8103.78)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Chrome", "source": "cna", "vendor": "Google"}, "product": "chrome", "vendor": "google"}], "created": "2026-11-12T18:00:06.711995+00:00", "updated": "2026-11-13T03:15:13.790131+00:00", "vendors": ["google", "google$PRODUCT$chrome"]}