Live › vulnerability › CVE-2026-121125
Google Chrome versions before 157.0.8103.38 have an information leak in ServiceWorker. A remote attacker who had already compromised the renderer process can read sensitive information through a crafted HTML page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any device running Google Chrome before 157.0.8103.38 is in scope. The attacker must first compromise the renderer process, so this is a chained flaw rather than a standalone takeover. Teams that manage browsers on company machines should check their fleet versions.
No product ranges from the sources yet.
google-chrome --version on Linux157.0.8103.38157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Information leak in ServiceWorker in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
This page as .md · .json · in your agent: get_signal("CVE-2026-121125")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.