Google Chrome: Missing authorization in Animation allows origin policy bypass
Summary
A missing authorization check in the Animation component of Chrome's Blink rendering engine allows a remote attacker to bypass the web origin policy. The attacker needs a victim to open a crafted HTML page, so user interaction is required. The Chromium tracker classifies the impact as a security-mechanism bypass with information disclosure, so confidentiality impact should be assumed until Google clarifies the advisory.
Affected
- Google Chrome prior to 156.0.8078.47 (NVD/CNA version boundary)
- Sources disagree on the exact range; VulDB lists up to 155.0.8059.84 and the Chrome Releases post should be checked for final build numbers
- Chromium-based browsers may need their own updates
- Ubuntu lists its chromium-browser package as not affected because it installs a Snap
Fixed in
- Google Chrome 156.0.8078.47 and later (per secondary reports; verify against the Chrome Releases post)
Workaround
- None documented by the vendor. Installing the fixed build is the remediation.
- Restart the browser after updating so the new version is actually running.
Exploitation
- No known exploitation in the wild found.
- Not listed in CISA KEV; EPSS 0.24%.
- CISA SSVC: exploitation status 'poc', not automatable.
- No public proof of concept found; the Chromium bug tracker was opened to the public after the fix.
Our recommendation
- Update Google Chrome to 156.0.8078.47 or later on all endpoints and verify the installed version.
- Restart browsers after the update.
- Check managed, offline and locked-down endpoints, and Chromium-based applications that bundle their own engine.
- Prioritise users who browse untrusted websites.
- Read the Chrome Releases post to confirm the fixed build numbers.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker 537109293 issues.chromium.org
- NVD record via Vulners vulners.com
- VulDB entry 424299 vuldb.com
- Ubuntu security CVE-2026-113128 ubuntu.com
- GBHackers: Chrome 156 fixes 353 vulnerabilities gbhackers.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 13:53.
Original description (NVD)
Missing authorization in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.