Live › vulnerability › CVE-2026-121029
Google Chrome's ORB (Opaque Response Blocking) component has an incorrect authorization check that lets a crafted HTML page bypass site isolation. An attacker who gets a victim to visit that page could read data from other sites the victim is logged into.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running Google Chrome before 157.0.8103.38 is exposed, since the flaw is in the browser itself and is triggered by visiting a malicious page. Teams can skip this for systems that do not run Chrome, though other Chromium-based browsers may carry the same flaw depending on their update schedule, which the sources do not say.
No product ranges from the sources yet.
google-chrome --version on Linux.157.0.8103.38 as affected.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
This page as .md · .json · in your agent: get_signal("CVE-2026-121029")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.