Live › vulnerability › CVE-2026-121194
Google Chrome's Site Isolation component is missing an authorization check, so a remote attacker who has already compromised the renderer process can read sensitive information through a crafted PDF file. Chromium rates it Medium severity.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any device running Google Chrome before 157.0.8103.38 is affected. Exploitation needs a renderer compromise first, so the flaw is a second-stage issue that makes an existing browser exploit more damaging.
No product ranges from the sources yet.
chrome://settings/help or run google-chrome --version on Linux; versions before 157.0.8103.38 are listed as affected.157.0.8103.38.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted PDF file. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121194")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.