Google Chrome: Improper access control in ComputePressure
Summary
CVE-2026-113057 is an improper access control flaw in the ComputePressure web API of Google Chrome. A remote attacker can use a crafted HTML page to bypass the web origin policy, which is possible when a user visits that page. The CVE record rates it 8.8 (CVSS 3.1, high), while Chromium rates it Medium and VulDB rates it 6.3, so the severity is disputed.
Affected
- Google Chrome before 156.0.8078.47 (CVE record)
- VulDB lists the affected range up to 155.0.8059.84
Fixed in
- Google Chrome 156.0.8078.47 is the first fixed build named in the CVE text
- Newer stable builds are available; install the latest stable Chrome release
Workaround
- Unknown. No vendor-specific workaround has been identified; updating is the fix.
Exploitation
- CISA SSVC: exploitation none, not automatable.
- Not listed in CISA KEV according to the GitHub alert.
- No evidence of exploitation in the wild found.
- VulDB reports no available exploit but tags the entry with a "0-Day" label, which is unresolved.
- The linked Chromium tracker (502710681) has a proof-of-concept section for a related privacy bypass; it was not reproduced or included here.
Our recommendation
- Inventory all Chrome, Edge and other Chromium-based browsers and their versions.
- Update Chrome to the latest stable build, at least 156.0.8078.47, and apply Chromium updates from Linux distributions.
- Confirm the fleet is on a current build using MDM or Chrome Browser Cloud Management.
- Prioritise managed endpoints that browse the web.
- Re-check the NVD record and the Chromium tracker for changes, as the NVD record is marked Modified.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker 502710681 issues.chromium.org
- VulDB entry 424198 vuldb.com
- Vulners CVE record CVE-2026-113057 vulners.com
- GitHub alert CVE-2026-113057 github.com
- Microsoft MSRC update guide CVE-2026-113057 msrc.microsoft.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 14:27.
Original description (NVD)
Improper access control in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.