{"id":"CVE-2026-121088","kind":"vulnerability","aliases":["CVE-2026-121088"],"related":[],"title":"Chrome: missing permission check in PerformanceAPIs leaks cross-origin data","description":"Missing authorization in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","summary":"Google Chrome before 157.0.8103.38 fails to check authorization in its PerformanceAPIs, so a crafted web page can read data from other websites. Chromium rates it Medium severity.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","chrome","linux","macos","runtime","windows"],"not_affected_if":["chrome-up-to-date"],"how_to_check":"- Check the installed Chrome version at chrome://settings/help\n- Confirm the version is `157.0.8103.38` or later","fix":"- Google Chrome: move to `157.0.8103.38` or later","status":"open","published_at":"2026-11-03T21:17:14+00:00","first_seen_at":"2026-11-03T21:19:12+00:00","triaged_at":"2026-11-03T21:25:32+00:00","updated_at":"2026-11-03T21:25:32+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-03T21:25:32Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: move to `157.0.8103.38` or later","reach":"internet","title":"Chrome: missing permission check in PerformanceAPIs leaks cross-origin data","impact":"medium","summary":"Google Chrome before 157.0.8103.38 fails to check authorization in its PerformanceAPIs, so a crafted web page can read data from other websites. Chromium rates it Medium severity.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["chrome","browsers","windows","macos","linux"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker page reads cross-origin data from other sites","analyst_note":"","how_to_check":"- Check the installed Chrome version at chrome://settings/help\n- Confirm the version is `157.0.8103.38` or later","plain_action":"Update Google Chrome to version 157.0.8103.38 or later: Chrome menu > Help > About Google Chrome.","needs_analyst":false,"not_affected_if":["chrome-up-to-date"],"who_is_affected":"Any Chrome install older than 157.0.8103.38 is exposed when a user visits a malicious or compromised web page. Managed fleets that pin Chrome versions should treat it as in scope. Users on updated Chrome or on browsers that do not use this code path can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000667,"input_tokens":4108,"output_tokens":513,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121088':14A,17A '-2026':13A,16A '157.0.8103.38':27B,60C 'allow':61C 'attack':64C 'author':31B,52C 'browser':18B 'check':4A,30B 'chrome':1A,19B,25B,57C 'chromium':46B,76C 'craft':37B,73C 'cross':9A,68C 'cross-origin':8A,67C 'cve':12A,15A 'data':11A,42B,70C 'fail':28B 'googl':24B,56C 'html':74C 'leak':7A 'linux':20B 'maco':21B 'medium':49B,79C 'miss':2A,51C 'obtain':66C 'origin':10A,69C 'page':39B,75C 'performanceapi':6A,34B,54C 'permiss':3A 'prior':58C 'rate':47B 'read':41B 'remot':63C 'runtim':22B 'secur':77C 'sever':50B,78C 'via':71C 'web':38B 'websit':45B 'window':23B","nicknames":[],"mitigations":[],"who_affected":"Any Chrome install older than 157.0.8103.38 is exposed when a user visits a malicious or compromised web page. Managed fleets that pin Chrome versions should treat it as in scope. Users on updated Chrome or on browsers that do not use this code path can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.38 or later: Chrome menu > Help > About Google Chrome.","pkeys":[],"ptokens":[],"labels":["browsers","chrome","linux","macos","medium","runtime","windows"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121088","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121088","severity":null,"published_at":"2026-11-03T21:17:14+00:00","modified_at":"2026-11-03T21:17:14+00:00","first_seen_at":"2026-11-03T21:19:12+00:00","fetched_at":"2026-11-03T21:19:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}