Live › vulnerability › CVE-2026-121190
A crafted Chrome extension can display fake user interface elements, such as misleading prompts, in Google Chrome versions before 157.0.8103.38. A remote attacker who tricks a user into installing or using the extension can use the spoofed UI to deceive them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running Google Chrome before 157.0.8103.38 who has extensions installed or can be persuaded to install one. Managed fleets should check the Chrome version across endpoints. Users on current Chrome builds or without extensions are not exposed.
No product ranges from the sources yet.
157.0.8103.38 are in scope.chrome://extensions and remove any unfamiliar ones.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
UI misrepresentation in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Low)
This page as .md · .json · in your agent: get_signal("CVE-2026-121190")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.