Security Resilience

CVE-2026-113113

Access Control in Google Chrome ≤ 156.0.8078.47

Access Control
Published
20 October 2026
Modified
03 November 2026
Patch / advisory
View advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0033 26th percentile
Risk Priority 64 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-113113 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).

Operationally, ranked at the 26th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Medium)

CWE(s)
CWE-863

Related Threats

CVEs Like This One

CVE-2026-87468Same product: Google Chrome
CVE-2026-106372Same product: Google Chrome
CVE-2026-87626Same product: Google Chrome
CVE-2026-87471Same product: Google Chrome
CVE-2026-113023Same product: Google Chrome
CVE-2026-87629Same product: Google Chrome
CVE-2026-102330Same product: Google Chrome
CVE-2026-106253Same product: Google Chrome
CVE-2026-87485Same product: Google Chrome
CVE-2026-121107Same product: Google Chrome

Affected Assets

google
chrome
≤ 156.0.8078.47

Mitigating Controls

Mitigating Controls (NIST 800-53 r5)

Our mappings, made for this CVE.

SA-11 Developer Testing and Evaluation partial match

Developer testing and evaluation can discover use-after-free bugs through dynamic analysis or fuzzing.

SA-8 Security and Privacy Engineering Principles partial match

Engineering principles can require memory-safe constructs or languages that structurally avoid introducing use-after-free.

Mitigating Controls (ISO/IEC 27001:2022 Annex A)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.

A.8.3 Information access restriction mostly match
blocks

A.8.3's access restriction mechanisms, including granular per-user and per-identity controls, directly enforce correct authorization checks, preventing exploitation of incorrect authorization flaws.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-863, a class-level weakness, and none of its children carries one either.

References