Loading vulnerability…
Web Origin Policy Bypass in Google Chrome V8
CVE-2026-126875 is a missing authorization vulnerability in the V8 engine in Google Chrome before version 157.0.8103.78. A remote attacker can use a crafted HTML page to bypass web origin policy, undermining browser-enforced isolation between origins. Chromium classifies the vulnerability as High severity. The specific affected function and authorization-check failure are not publicly detailed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises browser-enforced origin boundaries and can permit unauthorized cross-origin operations. The associated CVSS v3 assessment identifies high integrity impact without confidentiality or availability impact. Arbitrary code execution, sandbox escape, and full-device compromise are not established for this vulnerability.
Patch, then assume compromise.
Upgrade Google Chrome to version 157.0.8103.78 or later and relaunch the browser to activate the update. Administrators should verify that the fixed version is deployed and running across managed devices. A fixed Debian Chromium package version is not specified.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.