CVE-2026-121212
Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted
CVSS
—
No CVSS
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 3, 2026 · Last modified: Nov 3, 2026 · CWE-863
Not enough EPSS history yet.
Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-921918.8 HIG—
———Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.
The specific flaw exists within the runScript function. The issue results from incorrect authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29192.9hCVE-2026-1166674.2 MED—
———Tanium addressed an improper access controls vulnerability in Discover.10hCVE-2026-1166643.1 LOW—
———Tanium addressed an improper access controls vulnerability in Discover.10hCVE-2026-1166616.5 MED—
———Tanium addressed an improper access controls vulnerability in Enforce.10hCVE-2026-121541——
———In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the approved entitlements. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.11hCVE-2026-120930——
———Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)11h