{"id":"CVE-2026-121162","kind":"vulnerability","aliases":["CVE-2026-121162"],"related":[],"title":"Chrome on Windows: notification UI can be spoofed by a crafted page","description":"UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","summary":"Google Chrome on Windows before 157.0.8103.38 let a crafted HTML page spoof elements of the notification UI. Per the description, an attacker must use social engineering to get the victim to visit the page, and Chromium rates it Low severity.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","runtime","windows"],"not_affected_if":["chrome-updated"],"how_to_check":"- Check the installed Chrome version (chrome://settings/help) on Windows machines and compare it to `157.0.8103.38`.","fix":"- Google Chrome on Windows: move to `157.0.8103.38` or later.","status":"open","published_at":"2026-11-03T21:17:24+00:00","first_seen_at":"2026-11-03T21:19:23+00:00","triaged_at":"2026-11-03T21:23:26+00:00","updated_at":"2026-11-03T21:23:26+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T21:23:26Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome on Windows: move to `157.0.8103.38` or later.","reach":"internet","title":"Chrome on Windows: notification UI can be spoofed by a crafted page","impact":"low","summary":"Google Chrome on Windows before 157.0.8103.38 let a crafted HTML page spoof elements of the notification UI. Per the description, an attacker must use social engineering to get the victim to visit the page, and Chromium rates it Low severity.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["chrome","windows","browser"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"user is shown spoofed notification UI, enabling social engineering","analyst_note":"","how_to_check":"- Check the installed Chrome version (chrome://settings/help) on Windows machines and compare it to `157.0.8103.38`.","plain_action":"Update Google Chrome on your Windows computer to version 157.0.8103.38 or later.","needs_analyst":false,"not_affected_if":["chrome-updated"],"who_is_affected":"Windows machines running Google Chrome older than 157.0.8103.38. The sources do not say whether managed or enterprise browsers are treated differently. Systems running a fixed Chrome build or non-Windows platforms are not described as affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000662,"input_tokens":4110,"output_tokens":502,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121162':15A,18A '-2026':14A,17A '157.0.8103.38':28B,75C 'allow':76C 'attack':44B,79C 'browser':19B 'chrome':1A,20B,24B,69C 'chromium':58B,92C 'craft':11A,31B,89C 'cve':13A,16A 'descript':42B 'element':35B,86C 'engin':48B,82C 'get':50B 'googl':23B,68C 'html':32B,90C 'let':29B 'leverag':80C 'low':61B,95C 'misrepresent':64C 'must':45B 'notif':4A,38B,66C 'page':12A,33B,56B,91C 'per':40B 'prior':73C 'rate':59B 'remot':78C 'runtim':21B 'secur':93C 'sever':62B,94C 'social':47B,81C 'spoof':8A,34B,84C 'ui':5A,39B,63C,85C 'use':46B 'via':87C 'victim':52B 'visit':54B 'window':3A,22B,26B,72C","nicknames":[],"mitigations":[],"who_affected":"Windows machines running Google Chrome older than 157.0.8103.38. The sources do not say whether managed or enterprise browsers are treated differently. Systems running a fixed Chrome build or non-Windows platforms are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome on your Windows computer to version 157.0.8103.38 or later.","pkeys":[],"ptokens":[],"labels":["browser","chrome","low","runtime","windows"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121162","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121162","severity":null,"published_at":"2026-11-03T21:17:24+00:00","modified_at":"2026-11-03T21:17:24+00:00","first_seen_at":"2026-11-03T21:19:23+00:00","fetched_at":"2026-11-03T21:19:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}