CVE WatchNov 5, 2026

CVE-2026-121134

Information loss in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a craf

CVSS

8.8

High

EPSS

0.3%

p24

KEV

—

Exploit Today

0-100

Published: Nov 3, 2026 · Last modified: Nov 5, 2026 · CWE-221

EPSS · 30d

0.2%EPSS · 30 days0.3%

2026-11-042026-11-07

Technical description

Information loss in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-760274.3 MED

14.4%

——4Information loss in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)4d CVE-2026-1132388.8 HIG

35.0%

——11Information loss in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)4d CVE-2026-1131088.8 HIG

37.6%

——11Information loss in Script in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)4d CVE-2026-1130266.5 MED

36.8%

——11Information loss in PDF in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)4d CVE-2026-1062874.3 MED

10.5%

——3Information loss in CORS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)25d CVE-2026-875356.5 MED

27.6%

——8Information loss or omission in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)58d