---
id: "CVE-2026-121242"
kind: "vulnerability"
aliases: ["CVE-2026-121242"]
title: "Chrome: WebPackaging input validation lets remote sites bypass origin policy"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browsers", "chrome", "desktop", "mobile", "runtime"]
not_affected_if: ["chrome-updated"]
published_at: "2026-11-03T21:17:34+00:00"
first_seen_at: "2026-11-03T21:19:29+00:00"
updated_at: "2026-11-03T21:21:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121242", "first_seen_at": "2026-11-03T21:19:29+00:00"}]
---

# Chrome: WebPackaging input validation lets remote sites bypass origin policy

Google Chrome before 157.0.8103.38 mishandles input in its WebPackaging feature, so crafted network traffic can bypass web origin policy. An attacker who lures a user to a malicious page could read or act on content from another site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Open Chrome, go to `chrome://settings/help` and read the installed version
- Compare against `157.0.8103.38`; anything older is in range

## Fix

- Google Chrome: `157.0.8103.38`

## Timeline

- 2026-11-03T21:19:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121242

## From the sources

Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_