Live › vulnerability › CVE-2026-121046
A flaw in how Chrome's WebAppInstalls handles authorization lets a remote attacker spoof the address bar using a crafted HTML page. Exploitation depends on social engineering, and Chromium rates it Low severity.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any device running Google Chrome before 157.0.8103.38 is exposed when a user opens a crafted HTML page. Organisations should check managed browser fleets for the version. unknown for any further detail the sources do not give.
No product ranges from the sources yet.
chrome://version; versions before 157.0.8103.38 are affected.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect authorization in WebAppInstalls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Low)
This page as .md · .json · in your agent: get_signal("CVE-2026-121046")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.