Live › vulnerability › CVE-2026-121122
Google Chrome versions before 157.0.8103.38 let a remote attacker craft an HTML page that spoofs UI elements in the Prompts dialog. Exploitation relies on social engineering, so a user has to be tricked into visiting the page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any device running Google Chrome before 157.0.8103.38 is potentially exposed, since the flaw is in the browser's own Prompts UI. Exploitation needs a user to open a crafted HTML page, so managed fleets with auto-update enabled are mostly covered once updated.
No product ranges from the sources yet.
google-chrome --version on Linux.157.0.8103.38.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
UI misrepresentation in Prompts in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121122")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.