CVE-2026-113128: Google Chrome Auth Bypass Vulnerability

CVE-2026-113128 Overview

CVE-2026-113128 is a missing authorization vulnerability [CWE-862] in the Animation component of Google Chrome. The flaw affects Chrome versions prior to 156.0.8078.47 and allows a remote attacker to bypass the web origin policy through a crafted HTML page. Google tracks this issue in the Chromium project with a Medium security severity rating, while the National Vulnerability Database assigns it a higher CVSS score due to broader impact scoring. Successful exploitation requires user interaction, specifically visiting an attacker-controlled page. The vulnerability affects the Chrome Stable channel on desktop platforms.

Critical Impact
A remote attacker can bypass the same-origin policy via a crafted HTML page, potentially exposing cross-origin content and enabling further browser-based attacks against end users.

Affected Products

Google Chrome versions prior to 156.0.8078.47
Chrome Stable channel for desktop (Windows, macOS, Linux)
Chromium-based browsers incorporating affected Animation component code

Discovery Timeline

2026-10-20 - CVE-2026-113128 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-113128

Vulnerability Analysis

The vulnerability resides in the Animation component of Chrome's rendering engine. The component fails to perform required authorization checks before granting access to resources that cross web origin boundaries. An attacker hosting a malicious HTML page can leverage Animation APIs to bypass the browser's same-origin policy, a core security boundary that isolates documents and scripts from different origins.

Bypassing this boundary enables cross-origin data exposure and can be chained with other browser weaknesses to escalate impact. The Chromium project classifies the underlying issue as Medium severity, while NVD's scoring reflects the broader downstream consequences of origin-policy bypass on confidentiality, integrity, and availability.

Root Cause

The root cause is a missing authorization check [CWE-862] within the Animation subsystem. When an animation operation references content or state tied to a different web origin, the code path does not verify that the requesting document is authorized to access that cross-origin resource. The absence of this check allows a document from one origin to influence or observe state belonging to another origin.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts an HTML page that invokes the vulnerable Animation functionality against a target origin. When a victim visits the page in an unpatched Chrome build, the browser performs the privileged animation operation without the required origin check. No authentication or prior access to the victim system is required. Full technical details are published in the Chromium Issue Tracker Entry.

No public proof-of-concept exploit code is available at the time of publication, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-113128

Indicators of Compromise

Chrome client versions reporting a build number lower than 156.0.8078.47 across the fleet
Browser telemetry showing navigation to unknown or newly registered domains serving HTML with heavy Web Animations API usage
Unexpected cross-origin content access events in web application logs that correlate with Chrome user agents on vulnerable builds

Detection Strategies

Inventory installed Chrome versions using endpoint management tooling and flag any host running a build below 156.0.8078.47
Monitor web proxy and DNS logs for user navigation to suspicious pages immediately preceding anomalous authentication or session activity in SaaS applications
Review Content Security Policy (CSP) violation reports from internal web applications for unexpected cross-origin frame or resource access attempts

Monitoring Recommendations

Enable browser version reporting through Chrome Enterprise policies and forward telemetry to the SIEM for continuous version compliance tracking
Correlate browser build versions with user activity to prioritize patching for high-risk users such as administrators and finance staff
Alert on sustained use of outdated Chrome builds beyond a defined patch window after the vendor release date

How to Mitigate CVE-2026-113128

Immediate Actions Required

Update Google Chrome to version 156.0.8078.47 or later on all desktop endpoints
Restart Chrome processes after update to ensure the patched binary is loaded; relying on background updates alone can leave long-running sessions exposed
Validate Chromium-derivative browsers (Edge, Brave, Opera, Vivaldi) for upstream patch adoption and update accordingly

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release documented in the Chrome Release Update. The fix is included in Chrome 156.0.8078.47 and later. Enterprise administrators should push the update through Chrome Browser Enterprise, Group Policy, or endpoint management platforms rather than waiting for user-driven updates.

Workarounds

Enforce Chrome auto-update policies through Group Policy or Chrome Browser Cloud Management to minimize patch delay
Restrict browsing to known-good sites for high-risk roles via web proxy allow-lists until patch deployment is confirmed fleet-wide
Deploy enterprise browser isolation for sessions involving sensitive web applications to contain any residual exploitation attempts

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version