CVE-2026-113057: Google Chrome Auth Bypass Vulnerability

CVE-2026-113057 Overview

CVE-2026-113057 is an improper access control vulnerability in the ComputePressure API of Google Chrome. The flaw affects Chrome versions prior to 156.0.8078.47 and allows a remote attacker to bypass the web origin policy using a crafted HTML page. Chromium classifies the security severity as Medium, while the NVD CVSS score is 8.8 (High). The weakness is categorized under [CWE-284: Improper Access Control]. Exploitation requires user interaction, such as visiting an attacker-controlled page. Successful exploitation can compromise confidentiality, integrity, and availability within the browser.

Critical Impact

A remote attacker can bypass Chrome's same-origin boundary through the ComputePressure interface, enabling cross-origin data access from a malicious web page.

Affected Products

• Google Chrome versions prior to 156.0.8078.47
• Chromium-based browsers that embed the vulnerable ComputePressure implementation
• Desktop Chrome Stable channel distributions

Discovery Timeline

• 2026-10-20 - CVE-2026-113057 published to NVD
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-113057

Vulnerability Analysis

The vulnerability resides in Chrome's ComputePressure API, part of the Compute Pressure specification that exposes CPU utilization telemetry to web applications. The implementation fails to enforce origin isolation correctly when handling pressure observations. An attacker-controlled page can leverage this flaw to read or influence state that should remain scoped to another web origin.

Because the browser process relays pressure data across contexts, improper access control at this boundary breaks the same-origin policy that web applications depend on. The flaw enables unauthorized cross-origin interactions without triggering normal security prompts. Exploitation requires the victim to load a crafted HTML page, which satisfies the user interaction requirement in the CVSS vector.

Root Cause

The root cause is a missing or incorrectly applied origin check inside the ComputePressure subsystem [CWE-284]. The component should restrict observation callbacks and state to the originating document context. Instead, the implementation permits access flows that cross origin boundaries, violating the browser's isolation contract.

Attack Vector

The attack vector is network-based and remote. An adversary hosts a malicious HTML page that instantiates PressureObserver or related ComputePressure interfaces to abuse the flawed access control path. When a victim visits the page, the malicious script can bypass the web origin policy and reach data or capabilities that belong to a different origin.

No authentication is required, and the attack complexity is low. The outcome can include disclosure of cross-origin content, tampering with cross-origin state, or disruption of the browser session. Technical details are tracked in Chromium Issue #502710681.

Detection Methods for CVE-2026-113057

Indicators of Compromise

• Chrome client telemetry showing browser versions earlier than 156.0.8078.47 after the patch release date
• Web traffic to untrusted domains serving HTML pages that reference PressureObserver or Compute Pressure interfaces alongside cross-origin fetches
• Browser crash reports or renderer anomalies originating from the ComputePressure component

Detection Strategies

• Inventory installed Chrome versions across managed endpoints and flag hosts running builds older than 156.0.8078.47.
• Inspect proxy and DNS logs for user navigations to newly registered or low-reputation domains immediately preceding anomalous browser behavior.
• Correlate endpoint process telemetry with web gateway logs to identify sessions where a single tab triggered unexpected cross-origin requests.

Monitoring Recommendations

• Enforce centralized Chrome update reporting through enterprise management policies and alert on stale versions.
• Monitor for script activity invoking PressureObserver from unexpected or newly observed origins on the corporate network.
• Track browser error and crash telemetry for signatures mapping to the ComputePressure subsystem.

How to Mitigate CVE-2026-113057

Immediate Actions Required

• Update Google Chrome to version 156.0.8078.47 or later on all managed desktops.
• Restart Chrome after the update so the patched binary is loaded for all user sessions.
• Verify Chromium-based third-party browsers have ingested the upstream fix before considering remediation complete.

Patch Information

Google addressed the issue in the Chrome Stable channel update documented in the Google Chrome Stable Update release notes. The fix is included in Chrome 156.0.8078.47 and later builds. Administrators should push the update through enterprise channels such as Google Admin Console, Microsoft Intune, or equivalent patch management tooling.

Workarounds

• Deploy enterprise policy to disable or restrict experimental web platform features where feasible until all endpoints are patched.
• Use web filtering to block navigation to untrusted sites for user populations that cannot be patched immediately.
• Enforce browser isolation or remote browser rendering for high-risk user groups accessing external content.

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Force an immediate update check via Chrome's omaha client (macOS)
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode oneshot -userInitiated YES