CVE-2026-118333 in Chrome
Summary
by MITRE • 10/28/2026
Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified as missing authorization within the video handling subsystem of Google Chrome, specifically in versions prior to 156.0.8078.73, represents a critical failure in enforcing web origin policies. This flaw allows a remote attacker to bypass security boundaries that are designed to isolate content from different origins. In modern web browsers, the same-origin policy is a fundamental security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. By exploiting this missing authorization check, an adversary can manipulate video-related APIs or elements to access data, state, or functionality associated with other domains without proper permission checks. This bypass effectively undermines the isolation model that protects user privacy and application integrity against cross-site scripting and data exfiltration attacks.
From a technical perspective, the root cause lies in the browser's media pipeline failing to validate whether the requesting context has the necessary privileges to access specific video resources or metadata across origin boundaries. When a crafted HTML page is loaded by an unsuspecting user, it can invoke methods related to video playback that inadvertently expose sensitive information or allow control over media elements belonging to other origins. This behavior deviates from expected security protocols where every interaction with cross-origin resources must be explicitly authorized through mechanisms such as Cross-Origin Resource Sharing headers or strict origin checks within the browser engine. The severity of this issue is classified as high by Chromium, indicating that it can lead to significant data leakage or unauthorized actions without requiring user interaction beyond visiting a malicious webpage.
The operational impact of this vulnerability extends beyond simple information disclosure. An attacker could potentially use this flaw to perform cross-site request forgery attacks against video streaming services, manipulate playback states on trusted sites, or extract sensitive metadata associated with media files hosted on other domains. In enterprise environments where browsers are used for secure communication and content consumption, such a bypass can lead to the leakage of proprietary information embedded in videos or unauthorized access to internal resources that rely on origin-based security assumptions. The ability to manipulate video elements across origins also opens avenues for more complex attack chains involving social engineering or further exploitation of related browser features.
To mitigate this risk, organizations and users must ensure that Google Chrome is updated to version 156.0.8078.73 or later immediately upon availability. This update contains the necessary patches to enforce proper authorization checks within the video subsystem, thereby restoring the integrity of web origin policies. Additionally, administrators should implement strict content security policies and consider deploying browser isolation technologies for high-risk browsing activities to reduce exposure to such vulnerabilities. Regular monitoring of vendor security advisories is essential to maintain a robust defense posture against evolving threats targeting browser engines.
This vulnerability aligns with CWE-284 Improper Access Control, as it involves the failure to properly restrict access to resources based on user identity or context. Furthermore, from an adversary perspective, this flaw facilitates techniques associated with ATT&CK T1059 Command and Scripting Interpreter through web browsers, specifically in how malicious scripts can leverage browser APIs for unauthorized actions. It also relates to CWE-352 Cross-Site Request Forgery if the bypass allows manipulation of state-changing operations on other origins. Understanding these classifications helps security teams prioritize remediation efforts and enhance monitoring capabilities to detect potential exploitation attempts targeting this specific weakness in Chrome's media handling logic.