Live › vulnerability › CVE-2026-121031
Google Chrome versions before 157.0.8103.38 have a missing authorization check in the PDF component. A remote attacker can use a crafted Chrome extension to get around web origin policy and reach a privileged page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any desktop browser running Chrome before 157.0.8103.38 is in scope, and the attack depends on a malicious extension being installed. Managed fleets that control extension installation are less exposed. The sources do not say whether mobile Chrome is affected.
No product ranges from the sources yet.
157.0.8103.38.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing authorization in PDF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121031")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.