Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.3

Google Chrome 120: Fingerprinting Exposes User Data

CVE-2026-26995 GHSA-rrxv-pmq9-x67r
Summary

A security issue in Chrome 120 allows websites to potentially identify users by their browser configuration. This affects users who have a non-default browser fingerprint. To protect user data, update to a newer version of Chrome or use a security-focused browser extension.

What to do
  • Update github.com refraction-networking to version 1.8.2.
Affected software
VendorProductAffected versionsFix available
github.com refraction-networking > 1.6.0 , <= 1.8.2 1.8.2
Original title
uTLS has a fingerprint vulnerability from missing padding extension for Chrome 120
Original description
The padding extension was incorrectly removed in utls for the non-pq variant of Chrome 120 fingerprint. Chrome removed this extension only when sending pq keyshares. Only this fingerprint is affected since newer fingerprints have pq keyshares by default and older fingerprints have this extension.

Affected symbols: `HelloChrome_120`

Fix commit: 8fe0b08e9a0e7e2d08b268f451f2c79962e6acd0

Thanks to telegram @acgdaily for reporting this issue.
Vulnerability type
CWE-200 Information Exposure
Published: 18 Feb 2026 · Updated: 11 Mar 2026 · First seen: 6 Mar 2026