Live › vulnerability › CVE-2026-121130
A flaw in how Google Chrome's Forms handle some inputs lets a remote attacker observe a difference in behavior and learn sensitive information. The attacker needs the victim to open a crafted HTML page; Chromium rates it Low severity.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running Google Chrome before 157.0.8103.38 who browses to untrusted pages is exposed. Managed fleets and Chromium-based browsers that share the same Forms code should be checked against their own patch levels.
No product ranges from the sources yet.
google-chrome --version157.0.8103.38157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
This page as .md · .json · in your agent: get_signal("CVE-2026-121130")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.