Chromium: CVE-2026-78980 Improper input validation in ReaderMode

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-78980

A flaw was found in ReaderMode in Google Chrome. A remote attacker, by leveraging social engineering, could exploit improper input validation to bypass the web origin policy. This allows the attacker to access a privileged page via a specially crafted HTML page, potentially leading to unauthorize...

Linux Distros Unpatched Vulnerability : CVE-2026-78980

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in ReaderMode in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin...

DEBIAN-CVE-2026-78980

Improper input validation in ReaderMode in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Low...

CVE-2026-78980

Improper input validation in ReaderMode in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Low...

CVE-2026-78980

Improper input validation in ReaderMode in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Low...

CVE-2026-78980

Improper input validation in ReaderMode in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Low...

EUVD-2026-66063

Improper input validation in ReaderMode in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Low...

CVE-2026-78980

CVE-2026-78980 is an improper input validation flaw in ReaderMode in Google Chrome prior to 152.0.7977.65 . A remote attacker, leveraging social engineering, can bypass the web origin policy to access a privileged page via a crafted HTML document. Red Hat notes this may lead to unauthorized actio...

CVE-2026-78980

Improper input validation in ReaderMode in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Low...

PT-2026-81587

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper input validation in ReaderMode allows a remote attacker to bypass the web origin policy—a security mechanism that restricts how a document or script loaded from one origin can...

CVE-2023-49060

An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the referrerpolicy attribute. This vulnerability affects Firefox for iOS 120...

CVE-2023-49060

An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the referrerpolicy attribute. This vulnerability affects Firefox for iOS 120...

Brave Software: New XSS vector in ReaderMode with %READER-TITLE-NONCE%

A new XSS vulnerability was discovered in Brave iOS 1.31.1 and higher, which allowed attackers to execute malicious scripts on ReaderMode pages. The vulnerability was caused by a relaxation of the CSP rule, which allowed scripts with nonce-%READER-TITLE-NONCE% to be executed. Attackers could...