Live › vulnerability › CVE-2026-121255
Google Chrome's Autofill AI feature had an incorrect authorization check before version 157.0.8103.38. A remote attacker who lures a user to a crafted HTML page can obtain data from other origins.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any Chrome installation older than 157.0.8103.38 may be exposed when a user visits a malicious page. Exposure to the Autofill AI feature specifically is unknown from the sources; managed or non-Chrome browsers are not described as affected.
No product ranges from the sources yet.
chrome://version in the address bar.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121255")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.