Live › vulnerability › CVE-2026-121054
Google Chrome before 157.0.8103.38 has an improper state validation flaw in its XML handling. A crafted HTML page can bypass web origin policy, which may let it read or act on data from other sites.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any user running Google Chrome before 157.0.8103.38 who visits a page an attacker controls. Exposure comes from browsing alone, with no special configuration needed. Chromium-based browsers may ship the same fix on their own schedule, which the sources do not cover.
No product ranges from the sources yet.
157.0.8103.38; anything older is affected157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
This page as .md · .json · in your agent: get_signal("CVE-2026-121054")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.