CVE-2026-121239 Details
Description
Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
A cross-origin information leak vulnerability has been identified in Google Chrome, specifically in the Core component, prior to version 157.0.8103.38. This vulnerability allows remote attackers to obtain sensitive data by exploiting how the browser handles mixed content navigation in iframes. When a cross-origin iframe is navigated to an insecure URL, the full URL, including query parameters, is leaked to the embedding page through Content Security Policy violation reports. This issue was discovered by Project Fortify, an experimental security initiative.
Users can update to Google Chrome version 157.0.8103.38 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html | [email protected] | Release NotesVendor Advisory |
| https://issues.chromium.org/issues/563355450 | [email protected] | Issue TrackingVendor AdvisoryExploitMitigation |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| google chrome | < 157.0.8103.38 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | Initial Analysis | [email protected] |
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |