{"id":"CVE-2026-121240","kind":"vulnerability","aliases":["CVE-2026-121240"],"related":[],"title":"Chrome: crafted network traffic can bypass system access restrictions","description":"Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)","summary":"Google Chrome before 157.0.8103.38 mishandles input in its Variations feature, which delivers configuration to the browser. A remote attacker sending crafted network traffic can bypass system access restrictions.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","desktop","package"],"not_affected_if":["chrome-at-or-above-157.0.8103.38"],"how_to_check":"- Check the installed Chrome version (`chrome://version` in the browser)\n- Compare it with the fixed version `157.0.8103.38`","fix":"- Google Chrome: `157.0.8103.38`","status":"open","published_at":"2026-11-03T21:17:34+00:00","first_seen_at":"2026-11-03T21:19:28+00:00","triaged_at":"2026-11-03T21:21:09+00:00","updated_at":"2026-11-03T21:21:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T21:21:09Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: `157.0.8103.38`","reach":"internet","title":"Chrome: crafted network traffic can bypass system access restrictions","impact":"medium","summary":"Google Chrome before 157.0.8103.38 mishandles input in its Variations feature, which delivers configuration to the browser. A remote attacker sending crafted network traffic can bypass system access restrictions.","audience":"everyone","category":"package","nicknames":[],"who_cares":["chrome","desktop","browser"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker bypasses system access restrictions via crafted network traffic","analyst_note":"","how_to_check":"- Check the installed Chrome version (`chrome://version` in the browser)\n- Compare it with the fixed version `157.0.8103.38`","plain_action":"Update Google Chrome to version 157.0.8103.38 or later.","needs_analyst":false,"not_affected_if":["chrome-at-or-above-157.0.8103.38"],"who_is_affected":"Any desktop install of Google Chrome older than 157.0.8103.38 is in scope, since the flaw sits in the browser's Variations component and is reached over the network. The sources do not describe a special configuration or a required account. Chromium security severity is rated Low.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000657,"input_tokens":4094,"output_tokens":495,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121240':12A,15A '-2026':11A,14A '157.0.8103.38':23B,58C 'access':8A,46B,66C 'allow':59C 'attack':38B,62C 'browser':16B,35B 'bypass':6A,44B,64C 'chrome':1A,17B,21B,55C 'chromium':72C 'configur':32B 'craft':2A,40B,69C 'cve':10A,13A 'deliv':31B 'desktop':18B 'featur':29B 'googl':20B,54C 'improp':48C 'input':25B,49C 'low':75C 'mishandl':24B 'network':3A,41B,70C 'packag':19B 'prior':56C 'remot':37B,61C 'restrict':9A,47B,67C 'secur':73C 'send':39B 'sever':74C 'system':7A,45B,65C 'traffic':4A,42B,71C 'valid':50C 'variat':28B,52C 'via':68C","nicknames":[],"mitigations":[],"who_affected":"Any desktop install of Google Chrome older than 157.0.8103.38 is in scope, since the flaw sits in the browser's Variations component and is reached over the network. The sources do not describe a special configuration or a required account. Chromium security severity is rated Low.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.38 or later.","pkeys":[],"ptokens":[],"labels":["browser","chrome","desktop","low","package"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121240","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121240","severity":null,"published_at":"2026-11-03T21:17:34+00:00","modified_at":"2026-11-03T21:17:34+00:00","first_seen_at":"2026-11-03T21:19:28+00:00","fetched_at":"2026-11-03T21:19:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}