93← Home

CVE-2026-118333 (CVSS 9.3): Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin po

Headline from NVD · compiled from 5 sources

Our analysis · checked against 12 sources

Chrome update fixes video flaw that bypassed origin protections; no exploitation reported

Google's Chrome 156.0.8078.73 update, released 27 October 2026, fixes CVE-2026-118333, a video flaw letting a remote attacker bypass web origin protections, one of 52 security fixes. NVD scores it 9.3, Red Hat 8.8 and VulDB 6.3; no exploitation has been reported, and Chromebooks had not yet received the patch.

The framing"CVSS 9.3" does reflect NVD's official score for the flaw. But Red Hat rates the same flaw 8.8 and VulDB 6.3, exploitation requires the victim's interaction, and no exploitation or public proof-of-concept has been confirmed.

What the headline leaves out

  • Other assessors score it lower: Red Hat 8.8, VulDB 6.3, against NVD's 9.3.
  • Google has reported no exploitation, and the flaw was not in CISA's Known Exploited Vulnerabilities catalog as of 28 October.
  • VulDB says an attack needs the victim's interaction, such as visiting a crafted page.
  • Chromebooks were still on the 20 October build, without the fix.

What happens next

Google says the rollout will continue over the coming days and weeks. Chrome Geek reports that no matching ChromeOS Stable update had been posted, leaving Chromebooks on the 20 October build. Google withholds technical details until most users have updated, so independent checks of the score and flaw type must wait. Watch for a ChromeOS update, a CISA KEV listing or any exploitation report.

Possible knock-on effects
  • Chromebooks without the ChromeOS update could stay exposed to this flaw after desktop and Android users are patched, which may matter most to schools and businesses running Chromebooks. (mechanism: Follows from ChromeOS lagging the Chrome desktop and Android release; no source assesses the risk.. Watch for: Google posting a ChromeOS Stable update containing 156.0.8078.73 or later.)
  • Once most users update and Google lifts its restriction on bug details, researchers could verify the flaw, and the competing scores (9.3, 8.8, 6.3) and CWE labels may be revised. (official assessment: Chromium Security policy of restricting bug details until most users have updated, as reported by CyberSecurityNews.. Watch for: The Chromium bug tracker entry becoming public, or NVD or VulDB revising the score or CWE.)

Sources: CVE-2026-118333 record (cve.org via threatint) (primary), NVD score tracker issue, Red Hat assessment via Vulners (primary), VulDB vulnerability entry 427618, VulDB CVE analysis, SecurityOnline: Chrome security update 156.0.8078.73, SecurityWeek: Chrome and Firefox updates patch over 200 vulnerabilities, Chrome Geek: Chrome 156 security update, CyberSecurityNews: Google fixes 52 Chrome security flaws, BeyondMachines: Google patches 52 Chrome vulnerabilities, PiunikaWeb: Latest Chrome 156 patch, OffSeq Threat Radar: CVE-2026-118333

Written in our own words from the sources above, and checked claim by claim before it was published. The report below says only what each outlet said.

The report: what outlets said

According to Cybersecuritynews.com, Google's Chrome 156 update fixes 52 security flaws, including CVE-2026-118333, "a missing authorization issue in Video."[1] One automated tracker reports that NVD scored the flaw CVSS 9.3[2]

Ubuntu's security tracker reports that the flaw "allowed a remote attacker to bypass web origin policy via a crafted HTML page"[3] in Chrome versions before 156.0.8078.73, and that Chromium rated its severity High[3].A GitHub vulnerability-alert issue built on NVD data lists a CVSS score of 9.3 (CVSS V31) and an EPSS score of 0.19%[2]. Other trackers give lower ratings: VulDB lists a base score of 6.3[4], and Vulners rates it 5.9, medium risk[5].According to VulDB, the flaw was named CVE-2026-118333 on 10/27/2026[4]. VulDB also says "upgrading to version 156.0.8078.73 eliminates this vulnerability."[4]Cybersecuritynews.com reports that the same release fixes four critical flaws in FileSystem, FileAPI, Skia, and Layout[1].Cybersecuritynews.com also notes that Google's notice does not "state that attackers have exploited these vulnerabilities."[1]

Listen to the songCritical CVEs — November 03, 2026

Sources

  1. [1]Google Fixes 52 Chrome Security Flaws, Including Four Critical Vulnerabilities
  2. [2][VULN ALERT] CVE-2026-118333 (risk 32.7) - google/chrome · Issue #3552 · astruzocyber/CVE · GitHub
  3. [3]CVE-2026-118333 | Ubuntu
  4. [4]CVE-2026-118333 Google Chrome Video improper authorization
  5. [5]CVE-2026-118333 - vulnerability database | Vulners.com

Every sentence here reports what a named outlet said, with a link to it. Compiled by 93 from the reporting below.

More in this topic

This topic, day by day

CVE-2026-118333 (CVSS 9.3): Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin po | 93