Live › vulnerability › CVE-2026-121042
Google Chrome on Android before 157.0.8103.38 has an authorization flaw in its Permissions component. A remote attacker can use a crafted HTML page to bypass system access restrictions on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any Android device running Google Chrome older than 157.0.8103.38 is exposed when a user opens a malicious web page. Users on managed Chrome builds or with auto-updates enabled are likely already patched. unknown on whether a specific permission is bypassed beyond what the description states.
No product ranges from the sources yet.
chrome://version in Chrome.157.0.8103.38.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121042")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.