CVE-2026-118337 in Chrome
Summary
by MITRE • 10/28/2026
Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified as an improper access control flaw within the forms handling subsystem of Google Chrome prior to version 156.0.8078.73 represents a significant breach in web origin policy enforcement. This class of vulnerabilities, categorized under CWE-269 Improper Privilege Management or more specifically CWE-862 Missing Authorization, allows an attacker to perform actions on behalf of a user without proper authorization checks. In the context of modern web browsers, the same-origin policy is a critical security mechanism that isolates documents from different origins to prevent malicious scripts on one page from obtaining access to sensitive data on another page. When this isolation fails due to improper access control within form processing logic, it undermines the fundamental trust model upon which secure web applications are built.
The technical flaw likely resides in how Chrome processes user input and submits forms across different domains or origins. An attacker can craft a malicious HTML page that exploits specific edge cases in the browser's form submission engine to trick the victim into submitting sensitive information to an unauthorized third-party domain, or conversely, allows the crafted page to read data from a legitimate site where the victim is authenticated. This bypass of web origin policy means that cross-origin requests are not properly restricted, enabling potential data exfiltration or session hijacking scenarios. The severity rating of High by Chromium security reflects the ease with which this can be triggered and the significant impact on user privacy and data integrity.
From an operational perspective, exploitation of this vulnerability requires social engineering elements such as a victim visiting a malicious website while logged into sensitive services like banking portals, email providers, or enterprise applications. Once visited, the crafted HTML page leverages the browser's native form handling capabilities to bypass origin checks. This could result in the leakage of personally identifiable information, authentication tokens, or other confidential data stored within forms on trusted sites. The impact extends beyond individual users to organizations that rely on web-based interfaces for critical operations, as it facilitates phishing attacks and unauthorized access to internal systems if those systems are accessible via standard HTTP/HTTPS protocols without additional protective layers like Content Security Policy headers configured correctly by the site administrators.
Mitigation strategies primarily involve updating Google Chrome to version 156.0.8078.73 or later, where these access control checks have been hardened and validated against known attack vectors. For organizations unable to immediately patch all endpoints, implementing strict Content Security Policy directives can help mitigate the impact by restricting form actions and data submission origins. Additionally, enabling features such as SameSite cookie attributes on sensitive cookies ensures that even if an origin policy bypass occurs, session tokens are not sent with cross-site requests. Regular security audits of web applications to ensure they do not rely solely on client-side validation for access control remain essential defense-in-depth measures against this class of vulnerabilities aligned with MITRE ATT&CK techniques related to browser-based attacks and credential harvesting.