{"id":"CVE-2026-121254","kind":"vulnerability","aliases":["CVE-2026-121254"],"related":[],"title":"Chrome: crafted web page leaks sensitive data through the Select element","description":"Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","summary":"A flaw in the Select dropdown of Google Chrome lets a crafted HTML page obtain sensitive information from the browser. Chromium rates it Medium severity, and the sources give no further detail on what data is exposed.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","desktop","runtime"],"not_affected_if":["chrome-updated"],"how_to_check":"- Check the installed Chrome version at chrome://settings/help and compare it with the fixed version listed below.","fix":"- Google Chrome: move to `157.0.8103.38` or later","status":"open","published_at":"2026-11-03T21:17:36+00:00","first_seen_at":"2026-11-03T21:19:29+00:00","triaged_at":"2026-11-03T21:20:56+00:00","updated_at":"2026-11-03T21:20:56+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T21:20:56Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: move to `157.0.8103.38` or later","reach":"internet","title":"Chrome: crafted web page leaks sensitive data through the Select element","impact":"low","summary":"A flaw in the Select dropdown of Google Chrome lets a crafted HTML page obtain sensitive information from the browser. Chromium rates it Medium severity, and the sources give no further detail on what data is exposed.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["chrome","browser","desktop"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Sensitive browser information leaks to a remote attacker's web page","analyst_note":"","how_to_check":"- Check the installed Chrome version at chrome://settings/help and compare it with the fixed version listed below.","plain_action":"Update Google Chrome to version 157.0.8103.38 or later: open the Chrome menu, go to Help > About Google Chrome, and let it install.","needs_analyst":false,"not_affected_if":["chrome-updated"],"who_is_affected":"Anyone running Google Chrome before 157.0.8103.38 who visits a page that an attacker controls or can inject content into. Managed fleets should check the Chrome version on each machine, since the sources do not say which platforms or channels are affected beyond that.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000661,"input_tokens":4093,"output_tokens":503,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121254':14A,17A '-2026':13A,16A '157.0.8103.38':68C 'allow':69C 'attack':72C 'browser':18B,41B 'chrome':1A,19B,30B,65C 'chromium':42B,82C 'craft':2A,33B,79C 'cve':12A,15A 'data':7A,56B 'desktop':20B 'detail':53B 'dropdown':27B 'element':11A 'expos':58B 'flaw':23B 'give':50B 'googl':29B,64C 'html':34B,80C 'inform':38B,59C,76C 'leak':5A,60C 'let':31B 'medium':45B,85C 'obtain':36B,74C 'page':4A,35B,81C 'prior':66C 'rate':43B 'remot':71C 'runtim':21B 'secur':83C 'select':10A,26B,62C 'sensit':6A,37B,75C 'sever':46B,84C 'sourc':49B 'via':77C 'web':3A","nicknames":[],"mitigations":[],"who_affected":"Anyone running Google Chrome before 157.0.8103.38 who visits a page that an attacker controls or can inject content into. Managed fleets should check the Chrome version on each machine, since the sources do not say which platforms or channels are affected beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.38 or later: open the Chrome menu, go to Help > About Google Chrome, and let it install.","pkeys":[],"ptokens":[],"labels":["browser","chrome","desktop","medium","runtime"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121254","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121254","severity":null,"published_at":"2026-11-03T21:17:36+00:00","modified_at":"2026-11-03T21:17:36+00:00","first_seen_at":"2026-11-03T21:19:29+00:00","fetched_at":"2026-11-03T21:19:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}