Threat database

An information leak vulnerability exists in the Paint component of Google Chrome versions prior to 157.0.8103.38. A remote attacker could exploit this flaw by crafting a malicious HTML page to obtain sensitive information. The vulnerability has been assigned a low severity rating by Chromium security.

An incorrect authorization vulnerability in the Chromoting component of Google Chrome prior to version 157.0.8103.38 allows a local attacker to bypass system access restrictions via a local program. The issue has been assigned a low security severity by Chromium. A fix is available in Chrome version 157.0.8103.38.

An incorrect authorization vulnerability in the Forms component of Google Chrome prior to version 157.0.8103.38 allows a remote attacker to bypass the web origin policy via a crafted HTML page. This issue was assigned a low severity by the Chromium security team and has been fixed in version 157.0.8103.38.

Incorrect authorization in WebAppInstalls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Low)

An information leak vulnerability exists in the ServiceWorker component of Google Chrome versions prior to 157.0.8103.38. A remote attacker who has already compromised the renderer process could exploit this flaw by using a crafted HTML page to obtain sensitive information. The vulnerability has been assigned a low severity by Chromium security.

A UI misrepresentation vulnerability in Google Chrome extensions prior to version 157.0.8103.38 allows a remote attacker to spoof UI elements via a crafted extension, potentially misleading users through social engineering. The issue has been fixed in version 157.0.8103.38. The Chromium security team rates this vulnerability as low severity.

UI misrepresentation in Transactions Platform in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

An information leak vulnerability exists in the Frames component of Google Chrome versions prior to 157.0.8103.38. This flaw allows a remote attacker to obtain sensitive information by crafting a malicious HTML page. The issue has been assigned a low severity rating by the Chromium security team. A fixed version, 157.0.8103.38, has been released to address this vulnerability.

Inadequate encryption strength in SSL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via crafted network traffic. (Chromium security severity: Low)

A use-after-free vulnerability in the Streaming component of Google Chrome prior to version 157.0.8103.38 allows an adjacent attacker to execute arbitrary code inside the sandbox via crafted network traffic. The vulnerability has been assigned a low severity by Chromium security. A fix is available in Chrome version 157.0.8103.38.

CVE-2026-121134 is a low severity vulnerability in Google Chrome's BackgroundFetch component prior to version 157.0.8103.38. It allows a remote attacker to bypass the web origin policy via a crafted HTML page, potentially causing information loss. The issue is fixed in Chrome version 157.0.8103.38.

A UI misrepresentation vulnerability in Google Chrome prior to version 157.0.8103.38 allowed a remote attacker to spoof the address bar using a crafted HTML page. This flaw could mislead users about the actual website they are visiting. The issue has been fixed in version 157.0.8103.38. The vulnerability is rated as low severity by Chromium security.

A security issue in Google Chrome prior to version 157.0.8103.38 allows a remote attacker to bypass the web origin policy via a crafted HTML page. This vulnerability affects the Platform component of Chrome and has been assigned a medium severity level by Chromium security. The issue is fixed in Chrome version 157.0.8103.38.

An incorrect authorization vulnerability in Google Chrome prior to version 157.0.8103.38 allows a remote attacker who has compromised the renderer process to bypass system access restrictions via a crafted HTML page. This issue has been fixed in version 157.0.8103.38.

Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Out of bounds read in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a crafted file. (Chromium security severity: Medium)

A race condition vulnerability exists in the Autofill feature of Google Chrome versions prior to 157.0.8103.38. This flaw could allow a remote attacker to potentially obtain sensitive information by leveraging a crafted HTML page. The issue has been fixed in version 157.0.8103.38.

Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)