Live › vulnerability › CVE-2026-121248
An incorrect authorization check in a Chrome API lets a crafted Chrome extension bypass system access restrictions. The attacker gets access the browser is meant to block, and the source rates it Medium severity in Chromium.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any device running Google Chrome before 157.0.8103.38 is exposed, since the flaw is in the browser's API handling of extensions. Exploitation requires a malicious extension to be installed, so managed browsers that block extension installs are less exposed. The sources do not say whether the bypass needs additional conditions.
No product ranges from the sources yet.
google-chrome --version on Linux; versions below 157.0.8103.38 are affected.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121248")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.