Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Google Chrome allows malicious extension to bypass restrictions

CVE-2026-121055 · published 1 day ago
Summary

Versions of Google Chrome before 157.0.8103.38 do not fully clean up after using developer tools. This lets a specially crafted Chrome extension escape the normal security limits, potentially giving an attacker more access than intended. Update Chrome to the latest version to ensure the cleanup is performed correctly.

What to do
  • Update google chrome to version 157.0.8103.38 or later.
Affected software
Ecosystem VendorProductAffected versions
– google chrome < 157.0.8103.38
Debian:12 debian chromium All versions
Original advisory text
Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low)
Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low)
References
Exploitation
<1% chance of attack within 30 days
Type
CWE-459Incomplete Cleanup
Timeline
Published3 Nov 2026
Updated4 Nov 2026
First seen3 Nov 2026
Sources
CVE-2026-121055 · NVD
CVE-2026-121055 · MITRE
DEBIAN-CVE-2026-121055 · OSV
Track software like this
Free during beta