Live › vulnerability › CVE-2026-121115
Chrome's Shopping feature failed to validate input, so a crafted network request could reach a privileged page it should not. Chromium rates it medium severity; the description does not say what the attacker can do on that page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running Google Chrome before 157.0.8103.38 who uses the Shopping feature may be exposed to a remote attacker sending crafted traffic. Managed fleets should confirm versions across browsers, since the description does not name extra conditions. Users on current Chrome builds are not affected.
No product ranges from the sources yet.
chrome://settings/help or google-chrome --version157.0.8103.38157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121115")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.