Live › vulnerability › CVE-2026-121096
Google Chrome's V8 JavaScript engine did not fully clean up some state, so a program already running on the same machine can read memory it should not see. Chromium rates the issue Medium severity.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running Google Chrome before 157.0.8103.38 on a machine where untrusted local programs could run. Browsing alone is not the described path; the attacker must already have local code execution. Machines with only trusted local software are lower risk but should still be updated.
No product ranges from the sources yet.
google-chrome --version on Linux.157.0.8103.38.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121096")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.