Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.6

Google Chrome before 157.0.8103.38 may run code from a fake web page

CVE-2026-121076 · published today
Summary

A flaw in the WebXR feature of Chrome versions older than 157.0.8103.38 could let an attacker who tricks a user into opening a specially crafted web page run code on the computer, bypassing Chrome’s security sandbox. This could lead to unauthorized actions or data theft. Update Chrome to the latest version or apply the released security patch to protect against this risk.

What to do
  • Update google chrome to version 157.0.8103.38 or later.
Affected software
VendorProductAffected versions
google chrome < 157.0.8103.38
Original advisory text
Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chrom...
Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
References
Severity
9.6 Critical
Type
CWE-416Use After Free
Timeline
Published3 Nov 2026
Updated3 Nov 2026
First seen3 Nov 2026
Sources
CVE-2026-121076 · NVD
CVE-2026-121076 · MITRE
Track software like this
Free during beta