CVE-2026-113030: Google Chrome V8 Auth Bypass Vulnerability

CVE-2026-113030 Overview

CVE-2026-113030 is an improper access control vulnerability [CWE-284] in the V8 JavaScript engine used by Google Chrome. The flaw affects all Chrome versions prior to 156.0.8078.47 and allows a remote attacker to potentially bypass the web origin policy using a crafted HTML page. Successful exploitation requires user interaction, such as visiting a malicious website. Google rates the Chromium security severity as Medium, while the NVD assigns a higher CVSS score reflecting the potential confidentiality, integrity, and availability impact of a same-origin policy bypass in the browser engine.

Critical Impact

An attacker who successfully bypasses the web origin policy can read or manipulate data from other origins, enabling theft of authenticated session data, cross-site data exfiltration, and account takeover.

Affected Products

• Google Chrome versions prior to 156.0.8078.47 on desktop platforms
• Chromium-based browsers that embed V8 builds older than 156.0.8078.47
• Applications using older Chromium Embedded Framework (CEF) builds based on affected V8 versions

Discovery Timeline

• 2026-10-20 - CVE-2026-113030 published to the National Vulnerability Database
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-113030

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. V8 enforces portions of the browser's security model, including isolation between web origins. An improper access control flaw in V8 allows JavaScript executed from one origin to reach resources that should be restricted to another origin.

Because the issue lives in the engine layer, standard browser-level same-origin checks can be sidestepped once a crafted HTML page triggers the flawed code path. The attacker needs no credentials and no local access. The victim only needs to load an attacker-controlled page or a page that embeds attacker-controlled content.

The NVD classifies the issue under CWE-284: Improper Access Control. Google tracks the issue as Chromium Issue #561660149.

Root Cause

The root cause is an access control deficiency inside V8 that fails to properly enforce origin boundaries during specific JavaScript operations. When these operations run, V8 does not consistently check that the calling context is permitted to access the target resource. The resulting bypass undermines the Same-Origin Policy that browsers rely on to isolate web applications.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page or injects it through an advertising network, a compromised site, or a phishing link. When a user running a vulnerable Chrome build loads the page, embedded JavaScript triggers the V8 code path that fails the origin check. The attacker's script then reads or manipulates data belonging to other origins loaded in the same browser session, such as webmail, SaaS consoles, or banking portals.

No public proof-of-concept, exploit code, or evidence of exploitation in the wild has been published. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-113030

Indicators of Compromise

• Chrome client telemetry showing browser version strings earlier than 156.0.8078.47 after the patch release window
• Browser renderer crashes or unusual V8 exceptions correlated with visits to unfamiliar domains
• Outbound requests from browser processes to attacker-controlled infrastructure immediately following a page load containing heavy inline JavaScript
• Unexpected cross-origin HTTP requests or data exfiltration patterns originating from chrome.exe or related renderer processes

Detection Strategies

• Inventory Chrome installations across the fleet and flag any build earlier than 156.0.8078.47 for remediation
• Correlate web proxy logs with endpoint process telemetry to detect browser sessions interacting with newly registered or low-reputation domains
• Monitor for anomalous child processes spawned by Chrome renderer processes, which can indicate chained exploitation beyond the origin bypass

Monitoring Recommendations

• Ingest browser version data and web proxy logs into a centralized analytics platform to track exposure and investigate suspicious page loads
• Alert on repeated renderer crashes or sandbox violations originating from the same URL or domain
• Track user navigation to pages flagged by threat intelligence feeds for malicious JavaScript or Chromium exploit activity

How to Mitigate CVE-2026-113030

Immediate Actions Required

• Update Google Chrome to version 156.0.8078.47 or later on all Windows, macOS, and Linux endpoints
• Restart Chrome after the update to ensure the patched V8 binary is loaded into memory
• Verify managed browser policies force automatic updates and prevent users from pinning older versions
• Audit Chromium-based browsers and embedded Chromium frameworks for equivalent patched releases

Patch Information

Google addressed CVE-2026-113030 in the Chrome Stable channel update to version 156.0.8078.47. Patch details and release notes are available in the Google Chrome Stable Channel Update. The underlying code change is tracked in Chromium Issue #561660149.

Workarounds

• Restrict browsing to trusted sites using enterprise URL allow-listing until the patch is deployed
• Deploy script-blocking or content security policies through managed browser configurations to limit untrusted JavaScript execution
• Use network-level filtering to block known malicious domains and newly registered domains in high-risk categories

# Example: Enforce minimum Chrome version via Group Policy on Windows
# Registry path for managed Chrome auto-update enforcement
reg add "HKLM\Software\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "156.0.8078.47" /f