Live › vulnerability › CVE-2026-121101
Google Chrome before 157.0.8103.38 has a missing authorization check in DevTools. A remote attacker who tricks a user into installing a crafted Chrome extension can bypass access restrictions and reach a privileged page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running Google Chrome older than 157.0.8103.38 is exposed. The attack needs a user to install a crafted extension, so people who install only trusted extensions face less risk. Chromium's own rating for this issue is Low.
No product ranges from the sources yet.
chrome://version157.0.8103.38157.0.8103.38Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted Chrome extension. (Chromium security severity: Low)
This page as .md · .json · in your agent: get_signal("CVE-2026-121101")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.