Web Origin Policy Bypass in Google Chrome
CVE-2026-121135

8.8HIGH

Key Information:

Vendor

Google
Status
Chrome
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121135?

A security flaw in Google Chrome versions prior to 157.0.8103.38 presents an opportunity for remote attackers to exploit the browser's web origin policy. By crafting a malicious HTML page, an attacker can successfully circumvent security protections intended to isolate web content. This vulnerability necessitates prompt updates to ensure user security and browser integrity.

Affected Version(s)

Chrome 157.0.8103.38

References

https://chromereleases.googleblog.com/2026/11/stable-chan...
https://issues.chromium.org/issues/578671521

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.