Live › vulnerability › CVE-2026-121120
Google Chrome before 157.0.8103.38 mishandles input in its Prerender feature. A remote attacker who already controls the renderer process can use a crafted HTML page to bypass web origin policy.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Desktop and mobile installs of Google Chrome before 157.0.8103.38 are in the stated range. The attacker must first compromise the renderer process, so this is a second-stage flaw rather than a standalone entry point. Teams that manage Chrome on endpoints should check their fleet versions.
No product ranges from the sources yet.
google-chrome --version on Linux.157.0.8103.38; anything older is in the stated range.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper input validation in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121120")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.