Live › vulnerability › CVE-2026-121103
Google Chrome versions before 157.0.8103.38 have an incorrect authorization bug in extensions. A remote attacker can use a crafted Chrome extension to obtain data from other origins.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any desktop Chrome install older than 157.0.8103.38 is exposed, since the flaw lives in the browser's extension handling. Exposure depends on a malicious extension or page reaching the data, so users who keep extensions to a trusted set are at lower risk. Managed fleets should confirm the Chrome version across machines.
No product ranges from the sources yet.
157.0.8103.38157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121103")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.