Live › vulnerability › CVE-2026-121207
Google Chrome on macOS prior to 157.0.8103.38 has an uninitialized resource bug in Dawn, Chrome's WebGPU graphics component. A remote attacker can lure a victim to a crafted HTML page and read memory outside the browser sandbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Only Chrome on macOS builds older than 157.0.8103.38 are named in the sources. Exposure needs a user to open a crafted HTML page, so any Mac browsing the web with an unpatched Chrome is in scope. Chrome on other platforms is not named in the sources.
No product ranges from the sources yet.
157.0.8103.38/Applications/Google Chrome.app/Contents/Info.plist (key CFBundleShortVersionString)157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Uninitialized resource in Dawn in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-121207")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.