{"id":"CVE-2026-121049","kind":"vulnerability","aliases":["CVE-2026-121049"],"related":[],"title":"Chrome: V8 out-of-bounds read lets a local attacker read memory","description":"Out of bounds read in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a crafted file. (Chromium security severity: Medium)","summary":"Google Chrome's V8 JavaScript engine has an out-of-bounds read that a local attacker can trigger with a crafted file to read process memory. Chromium rates it Medium severity.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","desktop","runtime","v8"],"not_affected_if":["chrome-157.0.8103.38-or-later"],"how_to_check":"- Open Chrome's version via `chrome://settings/help` and compare with the fixed version below\n- Check the installed version on managed machines with your endpoint management tool","fix":"- Google Chrome: `157.0.8103.38` or later","status":"open","published_at":"2026-11-03T21:17:09+00:00","first_seen_at":"2026-11-03T21:19:10+00:00","triaged_at":"2026-11-03T21:27:18+00:00","updated_at":"2026-11-03T21:27:18+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T21:27:18Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: `157.0.8103.38` or later","reach":"local","title":"Chrome: V8 out-of-bounds read lets a local attacker read memory","impact":"low","summary":"Google Chrome's V8 JavaScript engine has an out-of-bounds read that a local attacker can trigger with a crafted file to read process memory. Chromium rates it Medium severity.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["chrome","v8","desktop","browser"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker reads browser process memory from a crafted file","analyst_note":"","how_to_check":"- Open Chrome's version via `chrome://settings/help` and compare with the fixed version below\n- Check the installed version on managed machines with your endpoint management tool","plain_action":"Update Google Chrome to version 157.0.8103.38 or later.","needs_analyst":false,"not_affected_if":["chrome-157.0.8103.38-or-later"],"who_is_affected":"Any machine running Google Chrome older than 157.0.8103.38 is exposed, since the flaw is in the V8 engine that Chrome uses to run JavaScript. The attacker needs local access and a crafted file to be opened, so exposure is limited to users who open untrusted files. Systems on the latest Chrome release can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00067,"input_tokens":4089,"output_tokens":522,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121049':16A,19A '-2026':15A,18A '157.0.8103.38':68C 'allow':69C 'attack':11A,41B,72C 'bound':6A,36B,59C 'browser':20B 'chrome':1A,21B,26B,65C 'chromium':52B,80C 'craft':46B,78C 'cve':14A,17A 'desktop':22B 'engin':30B 'file':47B,79C 'googl':25B,64C 'javascript':29B 'let':8A 'local':10A,40B,71C 'medium':55B,83C 'memori':13A,51B,75C 'out-of-bound':3A,33B 'prior':66C 'process':50B 'rate':53B 'read':7A,12A,37B,49B,60C,74C 'runtim':23B 'secur':81C 'sever':56B,82C 'trigger':43B 'v8':2A,24B,28B,62C 'via':76C","nicknames":[],"mitigations":[],"who_affected":"Any machine running Google Chrome older than 157.0.8103.38 is exposed, since the flaw is in the V8 engine that Chrome uses to run JavaScript. The attacker needs local access and a crafted file to be opened, so exposure is limited to users who open untrusted files. Systems on the latest Chrome release can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.38 or later.","pkeys":[],"ptokens":[],"labels":["browser","chrome","desktop","medium","runtime","v8"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121049","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121049","severity":null,"published_at":"2026-11-03T21:17:09+00:00","modified_at":"2026-11-03T21:17:09+00:00","first_seen_at":"2026-11-03T21:19:10+00:00","fetched_at":"2026-11-03T21:19:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}