Live › vulnerability › CVE-2026-121116
Google Chrome's WebView on Android, before version 157.0.8103.38, lacks an authorization check. A remote attacker who has already compromised the renderer process can read sensitive information through a crafted HTML page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Android devices running Chrome or a WebView component older than 157.0.8103.38. The attacker must first compromise the renderer process, so this is a second-stage flaw rather than a standalone entry point. Desktop and iOS are not named in the sources.
No product ranges from the sources yet.
157.0.8103.38 is the fixed version named in the sources)157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121116")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.