CVE-2026-121254 Details
Description
Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
A vulnerability allowing information leakage has been identified in Google Chrome versions prior to 157.0.8103.38. This issue arises in the handling of select elements within forms, specifically when the Autofill feature is active. A remote attacker can exploit this vulnerability to access sensitive information from the user's Autofill profile, such as country or credit card expiry details, through a specially crafted HTML page. The leak occurs via the Selection.modify method, which can be used to read previewed Autofill values before the user has a chance to consent.
Users can update to Google Chrome version 157.0.8103.38 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html | [email protected] | Release NotesVendor Advisory |
| https://issues.chromium.org/issues/562225118 | [email protected] | Issue TrackingVendor AdvisoryExploitMitigation |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| google chrome | < 157.0.8103.38 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | Initial Analysis | [email protected] |
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |