Live › vulnerability › CVE-2026-121222
Google Chrome's Forms component did not check authorization correctly, so a crafted HTML page can get around web origin restrictions. The attacker gets to act across site boundaries in the browser, with Chromium rating the issue low severity.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running Google Chrome before 157.0.8103.38 who visits a page an attacker controls. Chromium-based browsers that pull in the same fix are also exposed, and managed fleets should confirm the Chrome version across all machines.
No product ranges from the sources yet.
chrome://settings/help and read the version number157.0.8103.38157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
This page as .md · .json · in your agent: get_signal("CVE-2026-121222")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.