CVE-2026-121170 Details

A vulnerability in Google Chrome's WebCodecs implementation prior to version 157.0.8103.38 allowed remote attackers to bypass web origin policies. This was achieved through a crafted HTML page that exploited improper resource control in WebCodecs. The vulnerability could be reproduced by creating a WebCodecs encoder or decoder in an extension's isolated world, then synchronously triggering a page-controlled event while the 'dequeue' event was active. This exploitation method took advantage of the fact that the 'flush()' method in WebCodecs did not properly propagate the caller's script state, allowing an attacker to access sensitive data from the extension's storage.

Users should update to Google Chrome version 157.0.8103.38 or later, where this vulnerability has been fixed.