CVE-2026-120930

MediumCVSS 5.4/10Last modified Nov 5, 2026

Description

Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Nov 3, 2026
Last modified: Nov 5, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1209319.6Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outsi CVE-2026-120945.3The Advanced Contact Form 7 - Compact DB plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability che CVE-2026-120957.2The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2 via the 'api_url CVE-2026-1209527.1An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a CVE-2026-1209534.3A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the drive CVE-2026-1209543.7A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number CVE-2026-1209557.5The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions durin CVE-2026-1209567.1The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoin CVE-2026-1209593.7A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can cause values returned for a query to be written outside the bounds of a buff CVE-2026-120975.3The User Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2. This is due to the CVE-2026-1209715.3A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by CVE-2026-1209745.3On affected platforms running Arista EOS with IPsec AutoVPN Feature configured with dynamic paths, the configured IPsec replay window may no