CVE-2026-113205

HighCVSS 8.8/10Last modified Nov 3, 2026

Description

Insufficient verification of data authenticity in Variations in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published
Oct 20, 2026
Last modified
Nov 3, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-1132068.8UI misrepresentation in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML paCVE-2026-1132078.8Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to bypass system acCVE-2026-1132088.8Information leak in ContextualSearch in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leakCVE-2026-1132096.5Incorrect authorization in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to bypass system access reCVE-2026-113216.4The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV iCVE-2026-1132108.8Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sCVE-2026-1132119.6Incorrect authorization in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer CVE-2026-1132128.3Use after free in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a cCVE-2026-1132138.8Injection in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements vCVE-2026-1132148.8Incorrect authorization in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypCVE-2026-1132158.8Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafCVE-2026-1132168.8Use of released resource in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pr
CVE-2026-113205: High severity, CVSS 8.8 | Vulnix