CVE-2026-121187
Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a craf
CVSS
—
No CVSS
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 3, 2026 · Last modified: Nov 3, 2026 · CWE-203
Not enough EPSS history yet.
Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-121223——
———Observable discrepancy in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)6hCVE-2026-121138——
———Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)6hCVE-2026-121130——
———Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)6hCVE-2026-114199—4.8%
——1`GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their 15-minute time buckets that stem from that user's activity in private repositories. Repository names and contents were not disclosed. For public-only tokens the heatmap now only counts activity visible to anonymous users.3dCVE-2026-1183388.8 HIG18.4%
——6Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)5hCVE-2026-1183129.6 CRI23.6%
——7Observable discrepancy in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)5h