Live › vulnerability › CVE-2026-121187
Google Chrome's Paint component has an observable discrepancy that a remote attacker can exploit through a crafted HTML page to obtain sensitive information. Chromium rates the issue Medium severity.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone browsing with Google Chrome builds before 157.0.8103.38 can be targeted by a crafted HTML page that an attacker controls. Managed fleets that pin Chrome versions or delay updates are the ones most likely to stay exposed. Browsers already on 157.0.8103.38 or later are not affected.
No product ranges from the sources yet.
google-chrome --version157.0.8103.38157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121187")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.