Medium · 5.4 CVE-2026-120930 EUVD-2026-116385GHSA-4vp5-8fmq-v52x

Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafte…

Published Nov 3, 2026 · Updated Nov 4, 2026 · Assigned by Chrome

Vendor: Google Product: Chrome Package: chromium Category: Browsers Ecosystem: Debian

Description

Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

Affected products

Vendor	Product	Affected	Fixed
Google	Chrome	156.0.8078.47 – < 156.0.8078.47	156.0.8078.47

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	chromium	156.0.8078.47-1	—
Debian 13	chromium	156.0.8078.47-1~deb13u1	—
Debian 12	chromium	156.0.8078.47-1~deb12u1	—