Live › vulnerability › CVE-2026-121242
Google Chrome before 157.0.8103.38 mishandles input in its WebPackaging feature, so crafted network traffic can bypass web origin policy. An attacker who lures a user to a malicious page could read or act on content from another site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any desktop or mobile Chrome install older than 157.0.8103.38 is exposed when it loads attacker-controlled network content. Browsing only trusted sites reduces but does not remove the risk. unknown whether non-default WebPackaging use is required, as the sources do not say.
No product ranges from the sources yet.
chrome://settings/help and read the installed version157.0.8103.38; anything older is in range157.0.8103.38Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121242")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.