Vulnerability record

CVE-2026-121213

ElevatedNo known exploitation

Patch status

Official fix available since Nov 4, 2026

Apply the vendor's update to every affected system. Check the fixed-in versions below where known.

Basis: Google Chrome Releases vendor advisory

Description

Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Affected products

Products affected by this vulnerability, with versions and the source of each entry
Product	Vendor	Affected versions	Fixed in	Source
Chrome	Google	< 157.0.8103.38	157.0.8103.38	NVD

Sources: NVD = NIST National Vulnerability Database.

Intelligence timeline

Developments from the last 30 days, newest first.

CVSS scoredUpdateNov 7, 2026
CVE-2026-121213 scored CVSS 6.5
Basis: NIST National Vulnerability Database

Coverage

CriticalPatch

Beta Channel Update for ChromeOS / ChromeOS Flex

Patch

Apply the vendor's security update for Chrome.

Google Chrome Releases · 2 sources

Vendor advisoryGoogle Chrome Releases
Vendor advisoryGoogle Chrome Releases

4 days agoHomeSMBEnterprise

References

chromereleases.googleblog.com https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html
issues.chromium.org https://issues.chromium.org/issues/574762568