Live › vulnerability › CVE-2026-121174
A crafted HTML page can make Google Chrome's BackgroundFetch feature bypass web origin policy, because it lacks an authorization check. An attacker who lures a user to the page can act across origin boundaries in the browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any browser running Chrome older than 157.0.8103.38 is exposed when it opens a crafted HTML page, so the risk is to end users who browse the web with Chrome. Managed fleets and kiosks running Chrome are in scope; users who only run a patched build are not affected.
No product ranges from the sources yet.
chrome://version and compare it to 157.0.8103.38157.0.8103.38157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-121174")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.