Live › vulnerability › CVE-2026-121198
A confused deputy flaw in the WebUI of Google Chrome before 157.0.8103.38 lets a remote attacker bypass web origin policy using a crafted HTML page. Chromium rates it Low severity and it needs social engineering to lure a user to the page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running Google Chrome older than 157.0.8103.38 is exposed, as the attack needs a user to visit a crafted HTML page. Managed or auto-updated browsers are likely already current; the sources do not say whether other Chromium-based browsers are affected.
No product ranges from the sources yet.
chrome://version.157.0.8103.38.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
This page as .md · .json · in your agent: get_signal("CVE-2026-121198")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.