---
id: "CVE-2026-121162"
kind: "vulnerability"
aliases: ["CVE-2026-121162"]
title: "Chrome on Windows: notification UI can be spoofed by a crafted page"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browser", "chrome", "runtime", "windows"]
not_affected_if: ["chrome-updated"]
published_at: "2026-11-03T21:17:24+00:00"
first_seen_at: "2026-11-03T21:19:23+00:00"
updated_at: "2026-11-03T21:23:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121162", "first_seen_at": "2026-11-03T21:19:23+00:00"}]
---

# Chrome on Windows: notification UI can be spoofed by a crafted page

Google Chrome on Windows before 157.0.8103.38 let a crafted HTML page spoof elements of the notification UI. Per the description, an attacker must use social engineering to get the victim to visit the page, and Chromium rates it Low severity.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Chrome version (chrome://settings/help) on Windows machines and compare it to `157.0.8103.38`.

## Fix

- Google Chrome on Windows: move to `157.0.8103.38` or later.

## Timeline

- 2026-11-03T21:19:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121162

## From the sources

UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_