Live › vulnerability › CVE-2026-121064
Google Chrome has an improper input validation flaw in its Performance component. A local program can use it to potentially execute arbitrary code inside the browser sandbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running Google Chrome before 157.0.8103.38 on a machine where a local program could run. The attacker must already have local code execution, so exposure is limited to shared or compromised machines. Managed fleets should confirm Chrome auto-update is working.
No product ranges from the sources yet.
chrome --version157.0.8103.38157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandbox via a local program. (Chromium security severity: Low)
This page as .md · .json · in your agent: get_signal("CVE-2026-121064")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.