Google fixes 52 Chrome flaws, including four critical bugs
Stable builds move to 156.0.8078.73/.74 on Windows and Mac and 156.0.8078.73 on Linux, with no exploitation stated.
68
Vulnerability1 · 1 read
CVE-2026-118333
Missing authorization in Google Chrome Video before 156.0.8078.73
- CVSS 3.1
- 9.3 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A missing authorization flaw in Chrome's Video component lets a remote attacker bypass web origin policy by convincing a user to open a crafted HTML page. Successful exploitation can break the browser's origin isolation, letting the attacker access data or content across site boundaries. Only users running Chrome versions before 156.0.8078.73 are affected.
What to do: Update Chrome to version 156.0.8078.73 or later; Chrome normally auto-updates, so relaunch the browser to apply the fix.
| Product | Affected | Fixed in |
|---|---|---|
| Google Chrome | prior to 156.0.8078.73 | 156.0.8078.73 |
Estimated exposure
massMillions of unpatched Chrome users — Chrome's global user base; requires user to visit attacker-controlled page, so exposure is limited to unpatched installs.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)