CVE-2026-120930
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted
CVSS
5.4
Média
EPSS
0.2%
p9
KEV
—
Exploit Today
3
0-100
Publicado: 3 de nov. de 2026 · Última mod.: 5 de nov. de 2026 · CWE-863
0.2%EPSS · 30 dias0.3%
2026-11-042026-11-05
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1233343.8 BAI—
———In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project9hCVE-2026-1233333.8 BAI—
———In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints9hCVE-2026-1233286.4 MÉD—
———In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab9hCVE-2026-1233267.1 ALT—
———In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension9hCVE-2026-1233247.7 ALT—
———In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible9hCVE-2026-1232993.1 BAI—
———In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible9h