Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Google Chrome before 157 can leak cross‑origin data

CVE-2026-121138 · published 1 day ago
Summary

Versions of Google Chrome earlier than 157.0.8103.38 may let a malicious web page read data from other sites. This happens because the browser's handling of cross‑origin requests is inconsistent. Update Chrome to the latest version to close the gap.

What to do
  • Update google chrome to version 157.0.8103.38 or later.
Affected software
Ecosystem VendorProductAffected versions
– google chrome < 157.0.8103.38
Debian:12 debian chromium All versions
Original advisory text
Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)
References
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-203Observable Discrepancy
Timeline
Published3 Nov 2026
Updated4 Nov 2026
First seen3 Nov 2026
Sources
CVE-2026-121138 · NVD
CVE-2026-121138 · MITRE
DEBIAN-CVE-2026-121138 · OSV
Track software like this
Free during beta