CVE-2026-113159

Modified Modified - Updated After Analysis

Improper Access Control in Google Chrome DevTools

Publication date: 2026-10-20

Last updated on: 2026-11-03

Assigner: Chrome

Description

Incorrect reference resolution in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-03

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113159

EUVD

EUVD-2026-105658

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 156.0.8078.47 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-706	The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper access control issue in DevTools within Google Chrome versions before 156.0.8078.47. It allows a remote attacker to potentially access sensitive information by exploiting a crafted HTML page.

Detection Guidance

This vulnerability involves improper access control in Google Chrome's DevTools. Detection primarily requires checking the installed version of Chrome. If your Chrome version is prior to 156.0.8078.47, it is vulnerable. Use commands like 'google-chrome --version' on Linux or check 'chrome://settings/help' in the browser to verify the version.

Impact Analysis

If you use an affected version of Chrome, a malicious website could trick you into visiting it and steal sensitive data like passwords or personal information through DevTools.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, potentially violating GDPR (data protection) or HIPAA (health information privacy) if sensitive user data is leaked.

Mitigation Strategies

Update Google Chrome to version 156.0.8078.47 or later to address the improper access control in DevTools.

Hi! I’m here to help you understand CVE-2026-113159. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...