Threat database

An incorrect authorization vulnerability in the Cross-Origin Resource Sharing (CORS) implementation of Google Chrome prior to version 157.0.8103.38 allows a remote attacker to bypass the web origin policy via a crafted HTML page, leveraging social engineering. This issue has been fixed in version 157.0.8103.38. The Chromium security team rates this vulnerability as low severity.

A vulnerability in Google Chrome prior to version 157.0.8103.38 involves incomplete cleanup in DevTools, which allows a remote attacker to bypass the web origin policy via a crafted HTML page. The issue has been assigned a low severity rating by Chromium security. A fix is available in version 157.0.8103.38.

An incorrect authorization vulnerability in the History component of Google Chrome prior to version 157.0.8103.38 allows a remote attacker to bypass system access restrictions via a crafted HTML page leveraging social engineering. The issue has been fixed in version 157.0.8103.38. The vulnerability is rated as low severity by Chromium security.

Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-121251 is a vulnerability in the V8 engine of Google Chrome prior to version 157.0.8103.38. It involves missing authorization that allows a remote attacker to bypass the web origin policy using a crafted HTML page. The issue has been fixed in version 157.0.8103.38. The Chromium security team rates the severity as low.

An observable discrepancy in form handling in Google Chrome versions prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. The issue was assigned a low severity by Chromium security. A fix is available in version 157.0.8103.38.

A UI misrepresentation vulnerability in the PageInfo feature of Google Chrome prior to version 157.0.8103.38 allows a remote attacker to spoof UI elements by crafting a malicious HTML page. This issue has been fixed in version 157.0.8103.38. The vulnerability is rated as low severity by Chromium security.

Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

A UI misrepresentation vulnerability in Google Chrome's Isolated feature prior to version 157.0.8103.38 allows a remote attacker to spoof UI elements via a crafted HTML page, potentially tricking users through social engineering. The issue is rated with low severity by Chromium security.

An incorrect authorization vulnerability in the Isolated component of Google Chrome prior to version 157.0.8103.38 allowed a remote attacker to spoof user interface elements using a crafted HTML page. This issue was assigned a low severity rating by Chromium security. The vulnerability has been fixed in Chrome version 157.0.8103.38.

A missing authorization vulnerability in the DevTools component of Google Chrome prior to version 157.0.8103.38 allows a remote attacker, via social engineering and a crafted Chrome extension, to bypass site isolation. The issue has been fixed in version 157.0.8103.38. The Chromium security team rates the severity as low.

A UI misrepresentation vulnerability in Google Chrome for Android versions prior to 157.0.8103.38 allows a remote attacker to spoof UI elements via a crafted HTML page, potentially misleading users through social engineering. The issue has been fixed in version 157.0.8103.38 and is rated with low severity by Chromium security.

An improper input validation vulnerability in the Network component of Google Chrome prior to version 157.0.8103.38 allows a remote attacker to bypass the web origin policy using a crafted HTML page. This issue has been fixed in version 157.0.8103.38. The Chromium security team rates the severity of this vulnerability as low.

Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted Chrome extension. (Chromium security severity: Low)

Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low)

An observable discrepancy in Cross-Origin Resource Sharing (CORS) in Google Chrome versions prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. The issue was assigned a low severity by Chromium security. A fix was released in version 157.0.8103.38.

Incorrect authorization in HID in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

UI misrepresentation in Payments in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

An incorrect authorization vulnerability in Google Chrome Core prior to version 157.0.8103.38 allowed remote attackers to bypass the web origin policy using a crafted HTML page. The issue was assigned a low severity by Chromium security. A fix is available in Chrome version 157.0.8103.38.