Live › vulnerability › CVE-2026-121067
A flaw in Chrome's PermissionElement lets a crafted HTML page misrepresent the browser's UI, so a user can be tricked by social engineering. Chromium rates it Medium severity.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any desktop or mobile install of Google Chrome older than the named fixed release can be exposed when a user visits a crafted page. Exposure depends on a user being lured to the page, so the browser fleet is the thing to check. Machines already on the fixed release can skip it.
No product ranges from the sources yet.
157.0.8103.38.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
UI misrepresentation in PermissionElement in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121067")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.