{"id":"CVE-2026-121116","kind":"vulnerability","aliases":["CVE-2026-121116"],"related":[],"title":"Chrome on Android: WebView authorization gap leaks data from crafted pages","description":"Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","summary":"Google Chrome's WebView on Android, before version 157.0.8103.38, lacks an authorization check. A remote attacker who has already compromised the renderer process can read sensitive information through a crafted HTML page.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","chrome","runtime","webview"],"not_affected_if":["chrome-updated","non-android"],"how_to_check":"- Check the installed Chrome/WebView version on Android devices (`157.0.8103.38` is the fixed version named in the sources)\n- Confirm which apps embed WebView and ship their own copy of it: unknown","fix":"- Chrome on Android: move to `157.0.8103.38` or later","status":"open","published_at":"2026-11-03T21:17:19+00:00","first_seen_at":"2026-11-03T21:19:18+00:00","triaged_at":"2026-11-03T21:25:03+00:00","updated_at":"2026-11-03T21:25:03+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T21:25:03Z","model":"claude-haiku-5-5","output":{"fix":"- Chrome on Android: move to `157.0.8103.38` or later","reach":"internet","title":"Chrome on Android: WebView authorization gap leaks data from crafted pages","impact":"low","summary":"Google Chrome's WebView on Android, before version 157.0.8103.38, lacks an authorization check. A remote attacker who has already compromised the renderer process can read sensitive information through a crafted HTML page.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["android","chrome","webview"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Sensitive information leaks from the browser to an attacker's page","analyst_note":"","how_to_check":"- Check the installed Chrome/WebView version on Android devices (`157.0.8103.38` is the fixed version named in the sources)\n- Confirm which apps embed WebView and ship their own copy of it: unknown","plain_action":"Update Chrome on your Android phone to version 157.0.8103.38 or later through the Play Store.","needs_analyst":false,"not_affected_if":["chrome-updated","non-android"],"who_is_affected":"Android devices running Chrome or a WebView component older than 157.0.8103.38. The attacker must first compromise the renderer process, so this is a second-stage flaw rather than a standalone entry point. Desktop and iOS are not named in the sources.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000674,"input_tokens":4110,"output_tokens":525,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121116':14A,17A '-2026':13A,16A '157.0.8103.38':30B,66C 'allow':67C 'alreadi':40B 'android':3A,18B,27B,63C 'attack':37B,70C 'author':5A,33B,55C 'check':34B 'chrome':1A,19B,23B,60C 'chromium':86C 'compromis':41B,73C 'craft':10A,51B,83C 'cve':12A,15A 'data':8A 'gap':6A 'googl':22B,59C 'html':52B,84C 'inform':48B,80C 'lack':31B 'leak':7A 'medium':89C 'miss':54C 'obtain':78C 'page':11A,53B,85C 'prior':64C 'process':44B,76C 'read':46B 'remot':36B,69C 'render':43B,75C 'runtim':20B 'secur':87C 'sensit':47B,79C 'sever':88C 'version':29B 'via':81C 'webview':4A,21B,25B,57C","nicknames":[],"mitigations":[],"who_affected":"Android devices running Chrome or a WebView component older than 157.0.8103.38. The attacker must first compromise the renderer process, so this is a second-stage flaw rather than a standalone entry point. Desktop and iOS are not named in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Chrome on your Android phone to version 157.0.8103.38 or later through the Play Store.","pkeys":[],"ptokens":[],"labels":["android","chrome","medium","runtime","webview"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121116","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121116","severity":null,"published_at":"2026-11-03T21:17:19+00:00","modified_at":"2026-11-03T21:17:19+00:00","first_seen_at":"2026-11-03T21:19:18+00:00","fetched_at":"2026-11-03T21:19:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}