CVE-2026-118337
Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted
CVSS
—
No CVSS
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 27, 2026 · Last modified: Oct 27, 2026 · CWE-284
Not enough EPSS history yet.
Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-118318——
———Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)3hCVE-2026-829864.6 MED—
———The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.9hCVE-2026-829844.3 MED—
———When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers.
This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.9hCVE-2026-771734.3 MED—
———A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.9hCVE-2026-771713.5 LOW—
———A public shared collective always allowed recipients of the link to create pages.9hCVE-2026-674003.5 LOW—
———A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.9h