Live › vulnerability › CVE-2026-121108
Google Chrome versions before 157.0.8103.38 have a confused deputy flaw in the BackgroundFetch feature. A remote attacker can use a crafted HTML page to potentially bypass web origin policy.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running Google Chrome before 157.0.8103.38 who visits web pages, including untrusted ones. Exposure comes from the browser itself, not from a server-side configuration. Teams that manage browsers on employee machines should check versions there.
No product ranges from the sources yet.
157.0.8103.38157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121108")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.