Live › vulnerability › CVE-2026-121091
Google Chrome versions before 157.0.8103.38 have an authorization flaw in the Permissions component. A remote attacker who has already compromised the renderer process can use a crafted HTML page to obtain sensitive information.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running Google Chrome older than 157.0.8103.38 is exposed. The attack needs a renderer compromise first, so it is a second-stage flaw that is only reachable by visiting a crafted page.
No product ranges from the sources yet.
157.0.8103.38.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121091")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.