Search
Find a vulnerability
Search criteria
8386 vulnerabilities by google
CERTFR-2026-AVI-1450
Vulnerability from certfr_avis - Published: 2026-11-04 - Updated: 2026-11-04
De multiples vulnérabilités ont été découvertes dans Google Chrome. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Chrome versions ant\u00e9rieures \u00e0 157.0.8103.38 sur Linux et Windows",
"product": {
"name": "Chrome",
"vendor": {
"name": "Google",
"scada": false
}
}
},
{
"description": "Chrome versions ant\u00e9rieures \u00e0 157.0.8103.38 sur Mac",
"product": {
"name": "Chrome",
"vendor": {
"name": "Google",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-121112",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121112"
},
{
"name": "CVE-2026-121252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121252"
},
{
"name": "CVE-2026-121163",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121163"
},
{
"name": "CVE-2026-121127",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121127"
},
{
"name": "CVE-2026-121073",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121073"
},
{
"name": "CVE-2026-121084",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121084"
},
{
"name": "CVE-2026-121138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121138"
},
{
"name": "CVE-2026-121033",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121033"
},
{
"name": "CVE-2026-121064",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121064"
},
{
"name": "CVE-2026-121187",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121187"
},
{
"name": "CVE-2026-121113",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121113"
},
{
"name": "CVE-2026-121159",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121159"
},
{
"name": "CVE-2026-121218",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121218"
},
{
"name": "CVE-2026-121083",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121083"
},
{
"name": "CVE-2026-121136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121136"
},
{
"name": "CVE-2026-121082",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121082"
},
{
"name": "CVE-2026-121162",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121162"
},
{
"name": "CVE-2026-121207",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121207"
},
{
"name": "CVE-2026-121158",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121158"
},
{
"name": "CVE-2026-121109",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121109"
},
{
"name": "CVE-2026-121094",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121094"
},
{
"name": "CVE-2026-121030",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121030"
},
{
"name": "CVE-2026-121148",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121148"
},
{
"name": "CVE-2026-121219",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121219"
},
{
"name": "CVE-2026-121251",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121251"
},
{
"name": "CVE-2026-121035",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121035"
},
{
"name": "CVE-2026-121222",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121222"
},
{
"name": "CVE-2026-121041",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121041"
},
{
"name": "CVE-2026-121087",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121087"
},
{
"name": "CVE-2026-121205",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121205"
},
{
"name": "CVE-2026-121186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121186"
},
{
"name": "CVE-2026-121189",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121189"
},
{
"name": "CVE-2026-121114",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121114"
},
{
"name": "CVE-2026-121235",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121235"
},
{
"name": "CVE-2026-121050",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121050"
},
{
"name": "CVE-2026-121174",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121174"
},
{
"name": "CVE-2026-121088",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121088"
},
{
"name": "CVE-2026-121161",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121161"
},
{
"name": "CVE-2026-121224",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121224"
},
{
"name": "CVE-2026-121078",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121078"
},
{
"name": "CVE-2026-121102",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121102"
},
{
"name": "CVE-2026-121049",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121049"
},
{
"name": "CVE-2026-121081",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121081"
},
{
"name": "CVE-2026-121157",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121157"
},
{
"name": "CVE-2026-121177",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121177"
},
{
"name": "CVE-2026-121211",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121211"
},
{
"name": "CVE-2026-121232",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121232"
},
{
"name": "CVE-2026-121141",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121141"
},
{
"name": "CVE-2026-121044",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121044"
},
{
"name": "CVE-2026-121245",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121245"
},
{
"name": "CVE-2026-121055",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121055"
},
{
"name": "CVE-2026-121193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121193"
},
{
"name": "CVE-2026-121256",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121256"
},
{
"name": "CVE-2026-121097",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121097"
},
{
"name": "CVE-2026-121212",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121212"
},
{
"name": "CVE-2026-121124",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121124"
},
{
"name": "CVE-2026-121042",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121042"
},
{
"name": "CVE-2026-121100",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121100"
},
{
"name": "CVE-2026-121180",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121180"
},
{
"name": "CVE-2026-121237",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121237"
},
{
"name": "CVE-2026-121182",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121182"
},
{
"name": "CVE-2026-121194",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121194"
},
{
"name": "CVE-2026-121065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121065"
},
{
"name": "CVE-2026-121166",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121166"
},
{
"name": "CVE-2026-121196",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121196"
},
{
"name": "CVE-2026-121116",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121116"
},
{
"name": "CVE-2026-121206",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121206"
},
{
"name": "CVE-2026-121060",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121060"
},
{
"name": "CVE-2026-121254",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121254"
},
{
"name": "CVE-2026-121061",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121061"
},
{
"name": "CVE-2026-121201",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121201"
},
{
"name": "CVE-2026-121089",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121089"
},
{
"name": "CVE-2026-121059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121059"
},
{
"name": "CVE-2026-121107",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121107"
},
{
"name": "CVE-2026-121243",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121243"
},
{
"name": "CVE-2026-121188",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121188"
},
{
"name": "CVE-2026-121247",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121247"
},
{
"name": "CVE-2026-121038",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121038"
},
{
"name": "CVE-2026-121241",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121241"
},
{
"name": "CVE-2026-121125",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121125"
},
{
"name": "CVE-2026-121143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121143"
},
{
"name": "CVE-2026-121169",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121169"
},
{
"name": "CVE-2026-121075",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121075"
},
{
"name": "CVE-2026-121234",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121234"
},
{
"name": "CVE-2026-121178",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121178"
},
{
"name": "CVE-2026-121079",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121079"
},
{
"name": "CVE-2026-121128",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121128"
},
{
"name": "CVE-2026-121096",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121096"
},
{
"name": "CVE-2026-121257",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121257"
},
{
"name": "CVE-2026-121167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121167"
},
{
"name": "CVE-2026-121036",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121036"
},
{
"name": "CVE-2026-121066",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121066"
},
{
"name": "CVE-2026-121242",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121242"
},
{
"name": "CVE-2026-121090",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121090"
},
{
"name": "CVE-2026-121202",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121202"
},
{
"name": "CVE-2026-121074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121074"
},
{
"name": "CVE-2026-121214",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121214"
},
{
"name": "CVE-2026-121165",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121165"
},
{
"name": "CVE-2026-121230",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121230"
},
{
"name": "CVE-2026-121195",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121195"
},
{
"name": "CVE-2026-121054",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121054"
},
{
"name": "CVE-2026-121176",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121176"
},
{
"name": "CVE-2026-121216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121216"
},
{
"name": "CVE-2026-121085",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121085"
},
{
"name": "CVE-2026-121119",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121119"
},
{
"name": "CVE-2026-121185",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121185"
},
{
"name": "CVE-2026-121208",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121208"
},
{
"name": "CVE-2026-121137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121137"
},
{
"name": "CVE-2026-121067",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121067"
},
{
"name": "CVE-2026-121072",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121072"
},
{
"name": "CVE-2026-121092",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121092"
},
{
"name": "CVE-2026-121105",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121105"
},
{
"name": "CVE-2026-121239",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121239"
},
{
"name": "CVE-2026-121120",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121120"
},
{
"name": "CVE-2026-121115",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121115"
},
{
"name": "CVE-2026-121184",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121184"
},
{
"name": "CVE-2026-121126",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121126"
},
{
"name": "CVE-2026-121133",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121133"
},
{
"name": "CVE-2026-121179",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121179"
},
{
"name": "CVE-2026-121076",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121076"
},
{
"name": "CVE-2026-121168",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121168"
},
{
"name": "CVE-2026-121203",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121203"
},
{
"name": "CVE-2026-121233",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121233"
},
{
"name": "CVE-2026-121047",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121047"
},
{
"name": "CVE-2026-121221",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121221"
},
{
"name": "CVE-2026-121197",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121197"
},
{
"name": "CVE-2026-121093",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121093"
},
{
"name": "CVE-2026-121032",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121032"
},
{
"name": "CVE-2026-121057",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121057"
},
{
"name": "CVE-2026-121121",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121121"
},
{
"name": "CVE-2026-121220",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121220"
},
{
"name": "CVE-2026-121244",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121244"
},
{
"name": "CVE-2026-121131",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121131"
},
{
"name": "CVE-2026-121198",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121198"
},
{
"name": "CVE-2026-121070",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121070"
},
{
"name": "CVE-2026-121156",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121156"
},
{
"name": "CVE-2026-121046",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121046"
},
{
"name": "CVE-2026-121051",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121051"
},
{
"name": "CVE-2026-121217",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121217"
},
{
"name": "CVE-2026-121231",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121231"
},
{
"name": "CVE-2026-121246",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121246"
},
{
"name": "CVE-2026-121173",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121173"
},
{
"name": "CVE-2026-121210",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121210"
},
{
"name": "CVE-2026-121110",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121110"
},
{
"name": "CVE-2026-121095",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121095"
},
{
"name": "CVE-2026-121255",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121255"
},
{
"name": "CVE-2026-121111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121111"
},
{
"name": "CVE-2026-121183",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121183"
},
{
"name": "CVE-2026-121199",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121199"
},
{
"name": "CVE-2026-121086",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121086"
},
{
"name": "CVE-2026-121080",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121080"
},
{
"name": "CVE-2026-121091",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121091"
},
{
"name": "CVE-2026-121223",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121223"
},
{
"name": "CVE-2026-121129",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121129"
},
{
"name": "CVE-2026-121229",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121229"
},
{
"name": "CVE-2026-121142",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121142"
},
{
"name": "CVE-2026-121063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121063"
},
{
"name": "CVE-2026-121123",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121123"
},
{
"name": "CVE-2026-121104",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121104"
},
{
"name": "CVE-2026-121236",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121236"
},
{
"name": "CVE-2026-121204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121204"
},
{
"name": "CVE-2026-121200",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121200"
},
{
"name": "CVE-2026-121164",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121164"
},
{
"name": "CVE-2026-121040",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121040"
},
{
"name": "CVE-2026-121238",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121238"
},
{
"name": "CVE-2026-121130",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121130"
},
{
"name": "CVE-2026-121215",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121215"
},
{
"name": "CVE-2026-121077",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121077"
},
{
"name": "CVE-2026-121190",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121190"
},
{
"name": "CVE-2026-121034",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121034"
},
{
"name": "CVE-2026-121117",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121117"
},
{
"name": "CVE-2026-121122",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121122"
},
{
"name": "CVE-2026-121135",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121135"
},
{
"name": "CVE-2026-121069",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121069"
},
{
"name": "CVE-2026-121170",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121170"
},
{
"name": "CVE-2026-121048",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121048"
},
{
"name": "CVE-2026-121209",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121209"
},
{
"name": "CVE-2026-121250",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121250"
},
{
"name": "CVE-2026-121140",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121140"
},
{
"name": "CVE-2026-121172",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121172"
},
{
"name": "CVE-2026-121181",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121181"
},
{
"name": "CVE-2026-121052",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121052"
},
{
"name": "CVE-2026-121053",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121053"
},
{
"name": "CVE-2026-121248",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121248"
},
{
"name": "CVE-2026-121039",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121039"
},
{
"name": "CVE-2026-121031",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121031"
},
{
"name": "CVE-2026-121240",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121240"
},
{
"name": "CVE-2026-121175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121175"
},
{
"name": "CVE-2026-121118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121118"
},
{
"name": "CVE-2026-121071",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121071"
},
{
"name": "CVE-2026-121132",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121132"
},
{
"name": "CVE-2026-121101",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121101"
},
{
"name": "CVE-2026-121099",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121099"
},
{
"name": "CVE-2026-121062",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121062"
},
{
"name": "CVE-2026-121227",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121227"
},
{
"name": "CVE-2026-121045",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121045"
},
{
"name": "CVE-2026-121160",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121160"
},
{
"name": "CVE-2026-121253",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121253"
},
{
"name": "CVE-2026-121029",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121029"
},
{
"name": "CVE-2026-121171",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121171"
},
{
"name": "CVE-2026-121134",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121134"
},
{
"name": "CVE-2026-121103",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121103"
},
{
"name": "CVE-2026-121249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121249"
},
{
"name": "CVE-2026-121043",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121043"
},
{
"name": "CVE-2026-121228",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121228"
},
{
"name": "CVE-2026-121213",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121213"
},
{
"name": "CVE-2026-121098",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121098"
},
{
"name": "CVE-2026-121106",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121106"
},
{
"name": "CVE-2026-121037",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121037"
},
{
"name": "CVE-2026-121108",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121108"
},
{
"name": "CVE-2026-121226",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121226"
},
{
"name": "CVE-2026-121068",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121068"
},
{
"name": "CVE-2026-121225",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-121225"
}
],
"initial_release_date": "2026-11-04T00:00:00",
"last_revision_date": "2026-11-04T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1450",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-11-04T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Google Chrome. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Google Chrome",
"vendor_advisories": [
{
"published_at": "2026-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Google Chrome",
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
}
]
}
CVE-2026-120930 (GCVE-0-2026-120930)
Vulnerability from cvelistv5 – Published: 2026-11-03 21:20 – Updated: 2026-11-04 15:17
VLAI
EPSS
VEX
Summary
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 15:17 UTC
CWE
- CWE-863 - Incorrect authorization
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-120930",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T15:17:18.558978Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T15:17:21.456Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "156.0.8078.47",
"status": "affected",
"version": "156.0.8078.47",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T21:20:22.898Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html"
},
{
"url": "https://issues.chromium.org/issues/515948871"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-120930",
"datePublished": "2026-11-03T21:20:22.898Z",
"dateReserved": "2026-11-03T02:17:16.199Z",
"dateUpdated": "2026-11-04T15:17:21.456Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120931 (GCVE-0-2026-120931)
Vulnerability from cvelistv5 – Published: 2026-11-03 21:20 – Updated: 2026-11-05 04:55
VLAI
EPSS
VEX
Summary
Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 00:00 UTC
CWE
- CWE-787 - Out of bounds write
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-120931",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T04:55:45.077Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "156.0.8078.47",
"status": "affected",
"version": "156.0.8078.47",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out of bounds write",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T21:20:18.891Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html"
},
{
"url": "https://issues.chromium.org/issues/550607402"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-120931",
"datePublished": "2026-11-03T21:20:18.891Z",
"dateReserved": "2026-11-03T02:17:18.976Z",
"dateUpdated": "2026-11-05T04:55:45.077Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121141 (GCVE-0-2026-121141)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:43 – Updated: 2026-11-04 15:18
VLAI
EPSS
VEX
Summary
Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 15:18 UTC
CWE
- CWE-20 - Improper input validation
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121141",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T15:18:34.330359Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T15:18:37.637Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper input validation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:43:03.213Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/578083806"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121141",
"datePublished": "2026-11-03T20:43:03.213Z",
"dateReserved": "2026-11-03T09:58:12.511Z",
"dateUpdated": "2026-11-04T15:18:37.637Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121195 (GCVE-0-2026-121195)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:43 – Updated: 2026-11-04 20:21
VLAI
EPSS
VEX
Summary
Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:13 UTC
CWE
- CWE-863 - Incorrect authorization
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121195",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:13:16.222404Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:21:05.857Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:43:03.036Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/571784617"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121195",
"datePublished": "2026-11-03T20:43:03.036Z",
"dateReserved": "2026-11-03T10:26:43.363Z",
"dateUpdated": "2026-11-04T20:21:05.857Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121064 (GCVE-0-2026-121064)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:43 – Updated: 2026-11-05 04:55
VLAI
EPSS
VEX
Summary
Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandbox via a local program. (Chromium security severity: Low)
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 00:00 UTC
CWE
- CWE-20 - Improper input validation
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121064",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T04:55:54.346Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandbox via a local program. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper input validation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:43:02.836Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/570558711"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121064",
"datePublished": "2026-11-03T20:43:02.836Z",
"dateReserved": "2026-11-03T09:24:51.492Z",
"dateUpdated": "2026-11-05T04:55:54.346Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121169 (GCVE-0-2026-121169)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:43 – Updated: 2026-11-09 19:54
VLAI
EPSS
VEX
Summary
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 19:53 UTC
CWE
- CWE-862 - Missing authorization
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121169",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T19:53:14.740511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:54:22.403Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:43:02.655Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/569965757"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121169",
"datePublished": "2026-11-03T20:43:02.655Z",
"dateReserved": "2026-11-03T10:14:22.242Z",
"dateUpdated": "2026-11-09T19:54:22.403Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121069 (GCVE-0-2026-121069)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:43 – Updated: 2026-11-05 04:55
VLAI
EPSS
VEX
Summary
Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 00:00 UTC
CWE
- CWE-416 - Use after free
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121069",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T04:55:55.106Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use after free",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:43:02.465Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/568371493"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121069",
"datePublished": "2026-11-03T20:43:02.465Z",
"dateReserved": "2026-11-03T09:25:20.430Z",
"dateUpdated": "2026-11-05T04:55:55.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121142 (GCVE-0-2026-121142)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:43 – Updated: 2026-11-09 19:56
VLAI
EPSS
VEX
Summary
Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 19:55 UTC
CWE
- CWE-863 - Incorrect authorization
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121142",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T19:55:47.992934Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:56:15.491Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:43:02.292Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/567956457"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121142",
"datePublished": "2026-11-03T20:43:02.292Z",
"dateReserved": "2026-11-03T09:58:17.411Z",
"dateUpdated": "2026-11-09T19:56:15.491Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121232 (GCVE-0-2026-121232)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:43 – Updated: 2026-11-04 18:55
VLAI
EPSS
VEX
Summary
Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)
Severity
5.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 18:55 UTC
CWE
- CWE-863 - Incorrect authorization
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121232",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T18:55:09.162519Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T18:55:23.870Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:43:02.115Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/567846676"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121232",
"datePublished": "2026-11-03T20:43:02.115Z",
"dateReserved": "2026-11-03T10:33:32.833Z",
"dateUpdated": "2026-11-04T18:55:23.870Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121041 (GCVE-0-2026-121041)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:43 – Updated: 2026-11-04 18:50
VLAI
EPSS
VEX
Summary
Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 18:50 UTC
CWE
- CWE-862 - Missing authorization
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121041",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T18:50:27.058926Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T18:50:29.981Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:43:01.915Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/567726222"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121041",
"datePublished": "2026-11-03T20:43:01.915Z",
"dateReserved": "2026-11-03T09:23:24.755Z",
"dateUpdated": "2026-11-04T18:50:29.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121093 (GCVE-0-2026-121093)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:43 – Updated: 2026-11-09 19:57
VLAI
EPSS
VEX
Summary
Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Severity
5.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 19:56 UTC
CWE
- CWE-125 - Out of bounds read
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121093",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T19:56:54.920001Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:57:35.614Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out of bounds read",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:43:01.742Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/567429681"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121093",
"datePublished": "2026-11-03T20:43:01.742Z",
"dateReserved": "2026-11-03T09:29:13.891Z",
"dateUpdated": "2026-11-09T19:57:35.614Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121230 (GCVE-0-2026-121230)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:43 – Updated: 2026-11-05 04:55
VLAI
EPSS
VEX
Summary
Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 00:00 UTC
CWE
- CWE-362 - Race condition
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121230",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T04:55:55.874Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race condition",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:43:01.557Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/566683383"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121230",
"datePublished": "2026-11-03T20:43:01.557Z",
"dateReserved": "2026-11-03T10:33:27.735Z",
"dateUpdated": "2026-11-05T04:55:55.874Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121073 (GCVE-0-2026-121073)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:43 – Updated: 2026-11-05 04:55
VLAI
EPSS
VEX
Summary
Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Low)
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 00:00 UTC
CWE
- CWE-416 - Use after free
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121073",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T04:55:56.617Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use after free",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:43:01.364Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/565797214"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121073",
"datePublished": "2026-11-03T20:43:01.364Z",
"dateReserved": "2026-11-03T09:25:31.969Z",
"dateUpdated": "2026-11-05T04:55:56.617Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121092 (GCVE-0-2026-121092)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:43 – Updated: 2026-11-05 04:56
VLAI
EPSS
VEX
Summary
Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 00:00 UTC
CWE
- CWE-674 - Uncontrolled recursion
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121092",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T04:56:00.693Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled recursion",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:43:01.187Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/565674533"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121092",
"datePublished": "2026-11-03T20:43:01.187Z",
"dateReserved": "2026-11-03T09:29:02.719Z",
"dateUpdated": "2026-11-05T04:56:00.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121175 (GCVE-0-2026-121175)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:43 – Updated: 2026-11-09 19:59
VLAI
EPSS
VEX
Summary
Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 19:58 UTC
CWE
- CWE-668 - Improper resource exposure
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121175",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T19:58:30.869283Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:59:40.686Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-668",
"description": "Improper resource exposure",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:43:01.007Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/565505280"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121175",
"datePublished": "2026-11-03T20:43:01.007Z",
"dateReserved": "2026-11-03T10:16:23.293Z",
"dateUpdated": "2026-11-09T19:59:40.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121054 (GCVE-0-2026-121054)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:43 – Updated: 2026-11-04 20:21
VLAI
EPSS
VEX
Summary
Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:13 UTC
CWE
- CWE-754 - Improper state validation
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121054",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:13:31.283107Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:21:06.006Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "Improper state validation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:43:00.818Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/565252325"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121054",
"datePublished": "2026-11-03T20:43:00.818Z",
"dateReserved": "2026-11-03T09:24:19.693Z",
"dateUpdated": "2026-11-04T20:21:06.006Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121029 (GCVE-0-2026-121029)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:43 – Updated: 2026-11-09 20:00
VLAI
EPSS
VEX
Summary
Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:00 UTC
CWE
- CWE-863 - Incorrect authorization
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121029",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:00:36.686676Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:00:54.663Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:43:00.631Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/563877891"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121029",
"datePublished": "2026-11-03T20:43:00.631Z",
"dateReserved": "2026-11-03T09:22:52.534Z",
"dateUpdated": "2026-11-09T20:00:54.663Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121045 (GCVE-0-2026-121045)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:43 – Updated: 2026-11-04 21:01
VLAI
EPSS
VEX
Summary
UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 21:00 UTC
CWE
- CWE-451 - UI misrepresentation
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121045",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T21:00:22.157736Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:01:21.476Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-451",
"description": "UI misrepresentation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:43:00.449Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/563689651"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121045",
"datePublished": "2026-11-03T20:43:00.449Z",
"dateReserved": "2026-11-03T09:23:38.261Z",
"dateUpdated": "2026-11-04T21:01:21.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121162 (GCVE-0-2026-121162)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:43 – Updated: 2026-11-04 21:01
VLAI
EPSS
VEX
Summary
UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 21:00 UTC
CWE
- CWE-451 - UI misrepresentation
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121162",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T21:00:24.370490Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:01:21.621Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-451",
"description": "UI misrepresentation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:43:00.261Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/563362904"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121162",
"datePublished": "2026-11-03T20:43:00.261Z",
"dateReserved": "2026-11-03T10:13:59.579Z",
"dateUpdated": "2026-11-04T21:01:21.621Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121225 (GCVE-0-2026-121225)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:43 – Updated: 2026-11-09 19:45
VLAI
EPSS
VEX
Summary
Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 19:43 UTC
CWE
- CWE-863 - Incorrect authorization
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121225",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T19:43:58.536939Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:45:02.064Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:43:00.082Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/563349192"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121225",
"datePublished": "2026-11-03T20:43:00.082Z",
"dateReserved": "2026-11-03T10:33:15.539Z",
"dateUpdated": "2026-11-09T19:45:02.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121198 (GCVE-0-2026-121198)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:42 – Updated: 2026-11-04 20:21
VLAI
EPSS
VEX
Summary
Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:13 UTC
CWE
- CWE-441 - Confused deputy
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121198",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:13:46.294784Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:21:06.220Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "Confused deputy",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:42:59.904Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/563340726"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121198",
"datePublished": "2026-11-03T20:42:59.904Z",
"dateReserved": "2026-11-03T10:26:54.239Z",
"dateUpdated": "2026-11-04T20:21:06.220Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121240 (GCVE-0-2026-121240)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:42 – Updated: 2026-11-09 19:51
VLAI
EPSS
VEX
Summary
Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 19:46 UTC
CWE
- CWE-20 - Improper input validation
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121240",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T19:46:59.421653Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:51:38.411Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper input validation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:42:59.719Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/563181376"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121240",
"datePublished": "2026-11-03T20:42:59.719Z",
"dateReserved": "2026-11-03T10:34:08.792Z",
"dateUpdated": "2026-11-09T19:51:38.411Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121081 (GCVE-0-2026-121081)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:42 – Updated: 2026-11-04 18:55
VLAI
EPSS
VEX
Summary
UI misrepresentation in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to obtain sensitive information via crafted network traffic. (Chromium security severity: Low)
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 18:54 UTC
CWE
- CWE-451 - UI misrepresentation
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121081",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T18:54:57.395242Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T18:55:00.050Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "UI misrepresentation in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to obtain sensitive information via crafted network traffic. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-451",
"description": "UI misrepresentation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:42:59.546Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/562975181"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121081",
"datePublished": "2026-11-03T20:42:59.546Z",
"dateReserved": "2026-11-03T09:26:02.308Z",
"dateUpdated": "2026-11-04T18:55:00.050Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121050 (GCVE-0-2026-121050)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:42 – Updated: 2026-11-04 20:21
VLAI
EPSS
VEX
Summary
Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:14 UTC
CWE
- CWE-367 - Race condition
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121050",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:14:03.245696Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:21:06.373Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "Race condition",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:42:59.362Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/562964684"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121050",
"datePublished": "2026-11-03T20:42:59.362Z",
"dateReserved": "2026-11-03T09:23:52.694Z",
"dateUpdated": "2026-11-04T20:21:06.373Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121205 (GCVE-0-2026-121205)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:42 – Updated: 2026-11-04 20:21
VLAI
EPSS
VEX
Summary
Incorrect authorization in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:14 UTC
CWE
- CWE-863 - Incorrect authorization
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121205",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:14:18.834835Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:21:06.525Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:42:59.168Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/562957845"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121205",
"datePublished": "2026-11-03T20:42:59.168Z",
"dateReserved": "2026-11-03T10:28:46.384Z",
"dateUpdated": "2026-11-04T20:21:06.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121204 (GCVE-0-2026-121204)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:42 – Updated: 2026-11-04 20:21
VLAI
EPSS
VEX
Summary
Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:14 UTC
CWE
- CWE-459 - Incomplete cleanup
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121204",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:14:34.268578Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:21:06.672Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-459",
"description": "Incomplete cleanup",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:42:58.981Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/562957821"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121204",
"datePublished": "2026-11-03T20:42:58.981Z",
"dateReserved": "2026-11-03T10:28:44.642Z",
"dateUpdated": "2026-11-04T20:21:06.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121159 (GCVE-0-2026-121159)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:42 – Updated: 2026-11-09 20:12
VLAI
EPSS
VEX
Summary
Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:11 UTC
CWE
- CWE-863 - Incorrect authorization
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121159",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:11:50.378511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:12:37.694Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:42:58.789Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/562957377"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121159",
"datePublished": "2026-11-03T20:42:58.789Z",
"dateReserved": "2026-11-03T10:13:54.448Z",
"dateUpdated": "2026-11-09T20:12:37.694Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121085 (GCVE-0-2026-121085)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:42 – Updated: 2026-11-09 20:16
VLAI
EPSS
VEX
Summary
Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:14 UTC
CWE
- CWE-863 - Incorrect authorization
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121085",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:14:07.338747Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:16:00.982Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:42:58.604Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/562108905"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121085",
"datePublished": "2026-11-03T20:42:58.604Z",
"dateReserved": "2026-11-03T09:26:16.748Z",
"dateUpdated": "2026-11-09T20:16:00.982Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121251 (GCVE-0-2026-121251)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:42 – Updated: 2026-11-04 20:21
VLAI
EPSS
VEX
Summary
Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:14 UTC
CWE
- CWE-862 - Missing authorization
Assigner
Chrome
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-121251",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:14:49.552894Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:21:06.990Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "157.0.8103.38",
"status": "affected",
"version": "157.0.8103.38",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:42:58.414Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
},
{
"url": "https://issues.chromium.org/issues/561672123"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-121251",
"datePublished": "2026-11-03T20:42:58.414Z",
"dateReserved": "2026-11-03T10:34:57.175Z",
"dateUpdated": "2026-11-04T20:21:06.990Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}