{"id":"CVE-2026-121172","kind":"vulnerability","aliases":["CVE-2026-121172"],"related":[],"title":"Chrome: crafted web page can spoof browser UI elements","description":"Incorrect authorization in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","summary":"Google Chrome before 157.0.8103.38 has an authorization flaw in its Isolated component that lets a remote attacker display fake UI elements through a crafted HTML page. The source rates the Chromium security severity as Low and reports no code execution or data theft.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","desktop","package"],"not_affected_if":["chrome-up-to-date"],"how_to_check":"- Check the installed Chrome version in the browser's About page or with `chrome --version`.\n- Compare it against `157.0.8103.38`; anything older is in the affected range.","fix":"- Google Chrome: move to `157.0.8103.38` or later.","status":"open","published_at":"2026-11-03T21:17:25+00:00","first_seen_at":"2026-11-03T21:19:24+00:00","triaged_at":"2026-11-03T21:23:16+00:00","updated_at":"2026-11-03T21:23:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T21:23:16Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: move to `157.0.8103.38` or later.","reach":"internet","title":"Chrome: crafted web page can spoof browser UI elements","impact":"low","summary":"Google Chrome before 157.0.8103.38 has an authorization flaw in its Isolated component that lets a remote attacker display fake UI elements through a crafted HTML page. The source rates the Chromium security severity as Low and reports no code execution or data theft.","audience":"everyone","category":"package","nicknames":[],"who_cares":["chrome","browser","desktop"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker spoofs browser UI elements to mislead the user","analyst_note":"","how_to_check":"- Check the installed Chrome version in the browser's About page or with `chrome --version`.\n- Compare it against `157.0.8103.38`; anything older is in the affected range.","plain_action":"Update Google Chrome to version 157.0.8103.38 or later through its built-in update check.","needs_analyst":false,"not_affected_if":["chrome-up-to-date"],"who_is_affected":"Anyone running Google Chrome older than 157.0.8103.38 who visits untrusted web pages. Managed fleets that pin Chrome versions are exposed until updated. Users who only run newer Chrome builds can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000664,"input_tokens":4101,"output_tokens":508,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121172':12A,15A '-2026':11A,14A '157.0.8103.38':23B,72C 'allow':73C 'attack':36B,76C 'author':26B,64C 'browser':7A,16B 'chrome':1A,17B,21B,69C 'chromium':50B,86C 'code':58B 'compon':31B 'craft':2A,43B,83C 'cve':10A,13A 'data':61B 'desktop':18B 'display':37B 'element':9A,40B,80C 'execut':59B 'fake':38B 'flaw':27B 'googl':20B,68C 'html':44B,84C 'incorrect':63C 'isol':30B,66C 'let':33B 'low':54B,89C 'packag':19B 'page':4A,45B,85C 'prior':70C 'rate':48B 'remot':35B,75C 'report':56B 'secur':51B,87C 'sever':52B,88C 'sourc':47B 'spoof':6A,78C 'theft':62B 'ui':8A,39B,79C 'via':81C 'web':3A","nicknames":[],"mitigations":[],"who_affected":"Anyone running Google Chrome older than 157.0.8103.38 who visits untrusted web pages. Managed fleets that pin Chrome versions are exposed until updated. Users who only run newer Chrome builds can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.38 or later through its built-in update check.","pkeys":[],"ptokens":[],"labels":["browser","chrome","desktop","low","package"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121172","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121172","severity":null,"published_at":"2026-11-03T21:17:25+00:00","modified_at":"2026-11-03T21:17:25+00:00","first_seen_at":"2026-11-03T21:19:24+00:00","fetched_at":"2026-11-03T21:19:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}