Live › vulnerability › CVE-2026-121213
A flaw in how Google Chrome's Images component handles memory lets a crafted HTML page read cross-origin data. An attacker who gets a victim to open that page can obtain data from other sites the victim uses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any installation of Google Chrome before 157.0.8103.38 is affected, since the flaw is in the browser's image handling and needs only a visit to a crafted page. Chromium-based browsers that pick up the same fix are in the same position. Systems where the browser is not used for web browsing are less exposed.
No product ranges from the sources yet.
google-chrome --version on Linux.157.0.8103.38.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-121213")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.