{"id":"CVE-2026-121106","kind":"vulnerability","aliases":["CVE-2026-121106"],"related":[],"title":"Chrome for Android: Omnibox flaw leaks sensitive information to remote attackers","description":"Information leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to leak sensitive information via UI Interaction. (Chromium security severity: Medium)","summary":"A flaw in the Omnibox (address bar) of Google Chrome on Android lets a remote attacker leak sensitive information through UI interaction. Chromium rates it Medium severity.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","chrome","mobile","runtime"],"not_affected_if":["chrome-updated","non-android-platforms"],"how_to_check":"- Open Chrome on the Android device and check the version under Settings > About Chrome (the version must be compared with `157.0.8103.38`)\n- Check fleet-managed devices for Chrome versions below `157.0.8103.38`","fix":"- Chrome for Android: update to `157.0.8103.38` or later","status":"open","published_at":"2026-11-03T21:17:16+00:00","first_seen_at":"2026-11-03T21:19:14+00:00","triaged_at":"2026-11-03T21:25:12+00:00","updated_at":"2026-11-03T21:25:12+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T21:25:12Z","model":"claude-haiku-5-5","output":{"fix":"- Chrome for Android: update to `157.0.8103.38` or later","reach":"internet","title":"Chrome for Android: Omnibox flaw leaks sensitive information to remote attackers","impact":"low","summary":"A flaw in the Omnibox (address bar) of Google Chrome on Android lets a remote attacker leak sensitive information through UI interaction. Chromium rates it Medium severity.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["chrome","android","mobile"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"remote attacker reads sensitive information from the browser","analyst_note":"","how_to_check":"- Open Chrome on the Android device and check the version under Settings > About Chrome (the version must be compared with `157.0.8103.38`)\n- Check fleet-managed devices for Chrome versions below `157.0.8103.38`","plain_action":"Update Google Chrome on your Android phone to version 157.0.8103.38 or later through the Play Store.","needs_analyst":false,"not_affected_if":["chrome-updated","non-android-platforms"],"who_is_affected":"Any Android device running Chrome older than 157.0.8103.38 is affected, since the flaw is in the Omnibox of Chrome itself. Desktop Chrome and other browsers are not named in the source. Exploitation is described as needing UI interaction by the user.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000676,"input_tokens":4099,"output_tokens":533,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121106':14A,17A '-2026':13A,16A '157.0.8103.38':61C 'address':27B 'allow':62C 'android':3A,18B,33B,58C 'attack':11A,37B,65C 'bar':28B 'chrome':1A,19B,31B,55C 'chromium':44B,73C 'cve':12A,15A 'flaw':5A,23B 'googl':30B,54C 'inform':8A,40B,49C,69C 'interact':43B,72C 'leak':6A,38B,50C,67C 'let':34B 'medium':47B,76C 'mobil':20B 'omnibox':4A,26B,52C 'prior':59C 'rate':45B 'remot':10A,36B,64C 'runtim':21B 'secur':74C 'sensit':7A,39B,68C 'sever':48B,75C 'ui':42B,71C 'via':70C","nicknames":[],"mitigations":[],"who_affected":"Any Android device running Chrome older than 157.0.8103.38 is affected, since the flaw is in the Omnibox of Chrome itself. Desktop Chrome and other browsers are not named in the source. Exploitation is described as needing UI interaction by the user.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome on your Android phone to version 157.0.8103.38 or later through the Play Store.","pkeys":[],"ptokens":[],"labels":["android","chrome","medium","mobile","runtime"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121106","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121106","severity":null,"published_at":"2026-11-03T21:17:16+00:00","modified_at":"2026-11-03T21:17:17+00:00","first_seen_at":"2026-11-03T21:19:14+00:00","fetched_at":"2026-11-03T21:19:14+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}