Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page

Google Chrome2026-10-27 23:17 UTC1 min readRead in

Summary

Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

Remediation

Inventory every Google Chrome deployment, including staging.
Upgrade Google Chrome to 156.0.8078.73.
Confirm the running version after the upgrade.

References

CVSS vector

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: Required
Scope: Changed
Confidentiality: High
Integrity: High
Availability: None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Affected versions

Version	Fixed in
– <156.0.8078.73	156.0.8078.73

Weakness

CWE-284

Exploit probability (EPSS)

0.2%

Timeline

2026-10-27Publicly disclosed

Sources

NVD