{"id":"CVE-2026-121039","kind":"vulnerability","aliases":["CVE-2026-121039"],"related":[],"title":"Chrome: proxy authentication flaw lets nearby attacker obtain sensitive information","description":"Incorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)","summary":"Google Chrome's Proxy Auth component has an incorrect authorization check that lets an attacker on the same network segment read sensitive information through crafted network traffic. Chromium rates it Medium severity.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","desktop","other"],"not_affected_if":["patched-chrome"],"how_to_check":"- Check the installed Chrome version at chrome://settings/help and compare it to `157.0.8103.38`.\n- Check whether Chrome is configured to use an authenticated proxy.","fix":"- Google Chrome: move to `157.0.8103.38` or later.","status":"open","published_at":"2026-11-03T21:17:07+00:00","first_seen_at":"2026-11-03T21:19:09+00:00","triaged_at":"2026-11-03T21:27:29+00:00","updated_at":"2026-11-03T21:27:29+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-03T21:27:29Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: move to `157.0.8103.38` or later.","reach":"network","title":"Chrome: proxy authentication flaw lets nearby attacker obtain sensitive information","impact":"low","summary":"Google Chrome's Proxy Auth component has an incorrect authorization check that lets an attacker on the same network segment read sensitive information through crafted network traffic. Chromium rates it Medium severity.","audience":"everyone","category":"other","nicknames":[],"who_cares":["chrome","desktop","browser"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads sensitive information from proxied traffic on the local network","analyst_note":"","how_to_check":"- Check the installed Chrome version at chrome://settings/help and compare it to `157.0.8103.38`.\n- Check whether Chrome is configured to use an authenticated proxy.","plain_action":"Update Google Chrome to version 157.0.8103.38 or later: Chrome menu > Help > About Google Chrome.","needs_analyst":false,"not_affected_if":["patched-chrome"],"who_is_affected":"Chrome desktop users on a network where an attacker can send crafted traffic, most relevant on shared or untrusted networks with proxy authentication in use. Users on fully patched Chrome builds at or above 157.0.8103.38 are not affected. The sources do not describe a default-off feature.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00068,"input_tokens":4110,"output_tokens":538,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121039':13A,16A '-2026':12A,15A '157.0.8103.38':62C 'adjac':65C 'allow':63C 'attack':7A,34B,66C 'auth':24B,56C 'authent':3A 'author':29B,53C 'browser':17B 'check':30B 'chrome':1A,18B,21B,59C 'chromium':47B,75C 'compon':25B 'craft':44B,72C 'cve':11A,14A 'desktop':19B 'flaw':4A 'googl':20B,58C 'incorrect':28B,52C 'inform':10A,42B,70C 'let':5A,32B 'medium':50B,78C 'nearbi':6A 'network':38B,45B,73C 'obtain':8A,68C 'prior':60C 'proxi':2A,23B,55C 'rate':48B 'read':40B 'secur':76C 'segment':39B 'sensit':9A,41B,69C 'sever':51B,77C 'traffic':46B,74C 'via':71C","nicknames":[],"mitigations":[],"who_affected":"Chrome desktop users on a network where an attacker can send crafted traffic, most relevant on shared or untrusted networks with proxy authentication in use. Users on fully patched Chrome builds at or above 157.0.8103.38 are not affected. The sources do not describe a default-off feature.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.38 or later: Chrome menu > Help > About Google Chrome.","pkeys":[],"ptokens":[],"labels":["browser","chrome","desktop","medium","other"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121039","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121039","severity":null,"published_at":"2026-11-03T21:17:07+00:00","modified_at":"2026-11-03T21:17:07+00:00","first_seen_at":"2026-11-03T21:19:09+00:00","fetched_at":"2026-11-03T21:19:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}