Live › vulnerability › CVE-2026-121165
A crafted HTML page can make elements of Google Chrome's mobile interface on Android look different from what they really are. A remote attacker needs social engineering to lure a user to that page, and the source rates it Low severity.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Android devices running Chrome older than 157.0.8103.38 are exposed when a user opens an attacker-crafted HTML page. Desktop Chrome and other browsers are not named in the source. Users who keep Chrome auto-updated are likely already covered.
No product ranges from the sources yet.
chrome://version in the address bar.157.0.8103.38.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
UI misrepresentation in Mobile in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
This page as .md · .json · in your agent: get_signal("CVE-2026-121165")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.