Live › vulnerability › CVE-2026-121110
A crafted HTML page can make elements of the Shopping feature in Google Chrome on Android display misleading content. The sources describe UI spoofing only, with no code execution or data theft stated.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
People using Chrome on Android with the Shopping feature in versions before 157.0.8103.38. The sources describe a crafted HTML page as the trigger, so visiting an untrusted site is the exposure path. Desktop Chrome and other platforms are not mentioned in the sources.
No product ranges from the sources yet.
157.0.8103.38157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
UI misrepresentation in Shopping in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121110")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.