Live › vulnerability › CVE-2026-121062
Google Chrome before 157.0.8103.38 has an authorization flaw in an internal API. A remote attacker who has already compromised the renderer process, using a crafted HTML page, can bypass system access restrictions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running Google Chrome before 157.0.8103.38 on desktop systems is exposed. The attack needs a separate renderer compromise first, so the flaw is a second-stage escape rather than a standalone entry point. unknown for managed-browser or embedded Chromium builds, which depend on their own vendor updates.
No product ranges from the sources yet.
chrome://version in the browser or the Chrome version in the OS app list.157.0.8103.38.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121062")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.