Live › vulnerability › CVE-2026-121032
Google Chrome's Skia graphics library reads memory past the end of a buffer when it processes a crafted HTML page. A remote attacker who gets a user to open that page can read memory outside the browser sandbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any desktop or mobile install of Google Chrome older than 157.0.8103.38 is exposed when a user visits a malicious page. Browsers that are already updated, or that run only trusted internal pages, are lower risk. Other Chromium-based browsers may pick up the fix separately.
No product ranges from the sources yet.
chrome://version; anything below 157.0.8103.38 is affected.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-121032")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.