CVE-2026-121138
NoneCVSS
—
EPSS
0.2%
Published
Nov 3, 2026
CISA due date
—
The record
Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121223 Observable discrepancy in Media in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-203
- CVE-2026-121187 Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-203
- CVE-2026-121130 Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-203
- CVE-2026-114199 `GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the… CWE-203
- CVE-2026-118338 Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.73 allowed a… CWE-203
- CVE-2026-118312 Observable discrepancy in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote… CWE-203
- CVE-2026-65626 The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a… CWE-203
- CVE-2026-76406 In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted… CWE-203