---
id: "CVE-2026-121039"
kind: "vulnerability"
aliases: ["CVE-2026-121039"]
title: "Chrome: proxy authentication flaw lets nearby attacker obtain sensitive information"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["browser", "chrome", "desktop", "other"]
not_affected_if: ["patched-chrome"]
published_at: "2026-11-03T21:17:07+00:00"
first_seen_at: "2026-11-03T21:19:09+00:00"
updated_at: "2026-11-03T21:27:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121039", "first_seen_at": "2026-11-03T21:19:09+00:00"}]
---

# Chrome: proxy authentication flaw lets nearby attacker obtain sensitive information

Google Chrome's Proxy Auth component has an incorrect authorization check that lets an attacker on the same network segment read sensitive information through crafted network traffic. Chromium rates it Medium severity.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Chrome version at chrome://settings/help and compare it to `157.0.8103.38`.
- Check whether Chrome is configured to use an authenticated proxy.

## Fix

- Google Chrome: move to `157.0.8103.38` or later.

## Timeline

- 2026-11-03T21:19:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121039

## From the sources

Incorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_