CVE-2026-118337 (CVSS 9.3): Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin

OffSeq Threat Radar reports that the vulnerability was published 27 Oct 2026[1]. It also reports that Chrome, the CVE numbering authority, rated it "High"[1] and that a patch is "Available – fixed in 156.0.8078.73"[1]. As of 27 October, OffSeq said the flaw was "not yet scored by NVD,"[1] and Strix said "NVD analysis pending."[3] VulDB gives it its own base score of 6.3[4].According to VulDB, "exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim."[4]VulDB's extended analysis says the issue "likely resides in how Chrome processes user input and submits forms across different domains or origins."[5]OffSeq reports that the flaw is "Not in CISA KEV and no source reports exploitation."[1] VulDB likewise says "an exploit is not available."[4]Ubuntu's security tracker lists the vulnerability and links to Google's Chrome Releases stable channel update[6]. Strix identifies CVE-2026-118337 as one of several Chrome 156 fixes, among them use-after-free bugs in ImageCapture and Animation[3].OffSeq advises users to "Upgrade Google Chrome to 156.0.8078.73."[1]