5.3 Medium

CVE-2026-121039 Incorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to obtain…

Description

Incorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)

CVSS 3.1 detail

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitable from the adjacent network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Adjacent network
Attack complexity: High
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
Chrome 157.0	earliest → < 157.0.8103.38	157.0.8103.38

References

chromereleases.googleblog.com chromereleases.googleblog.com
issues.chromium.org issues.chromium.org

Timeline

Published November 3, 2026
Last modified November 4, 2026

The 6072 CVEs of Chrome →

CVE-2026-120930 Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web… 5.4 Medium CVE-2026-120931 Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to… 9.6 Critical CVE-2026-121195 Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass… 8.8 High CVE-2026-121141 Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social… 5.4 Medium

Track this CVE