CVE-2026-121187 Details
Description
Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
A vulnerability in the Paint component of Google Chrome, observed in versions prior to 157.0.8103.38, allows remote attackers to access sensitive information. This is achieved through a specially crafted HTML page that exploits an inconsistency in how the browser handles painting events. The issue arises from the improper management of spelling and grammar markers, which are meant to be kept private but can inadvertently reveal details about the user's custom dictionary. This leak occurs via a side channel in the canvas rendering process, where the absence of expected privacy protections allows web content to discern the spellcheck status of words, including those added to the user's dictionary.
Users can update to Google Chrome version 157.0.8103.38 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html | [email protected] | Release NotesVendor Advisory |
| https://issues.chromium.org/issues/563359033 | [email protected] | ExploitIssue TrackingVendor AdvisoryMitigation |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-203 | Observable Discrepancy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| google chrome | < 157.0.8103.38 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | Initial Analysis | [email protected] |
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |