CVE-2026-121140: Out of bounds read in Internals
Published Sep 6, 2026
·Updated
Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Credit
Popax21
Affected Software
5 affected componentsFixes available
Google Chrome<157.0.8103.38
157.0.8103.38
debian/chromium*
debian/chromium*
debian/chromium*
debian/chromium<=150.0.7871.100-1~deb12u1, <=156.0.8078.79-1~deb12u1, <=150.0.7871.181-1~deb13u1, <=156.0.8078.79-1~deb13u1, <=156.0.8078.47-1, <=156.0.8078.79-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 157.0.8103.38
Event History
Sep 6, 2026
CVE Published
12:00 AM
Data Sourced
12:00 AM
SeverityWeaknessAffected Software
Nov 3, 2026
CVE Published
via MITRE·08:42 PM
Data Sourced
via MITRE·08:42 PM
DescriptionWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeakness
Data Sourced
via OSV·09:17 PM
DescriptionSeverityAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-121156
- CVE-2026-121229
- CVE-2026-121246
- CVE-2026-121035
- CVE-2026-121247
- CVE-2026-121203
- CVE-2026-121126
- CVE-2026-121107
- CVE-2026-121197
- CVE-2026-121112
- CVE-2026-121174
- CVE-2026-121098
- CVE-2026-121074
- CVE-2026-121173
- CVE-2026-121233
- CVE-2026-121095
- CVE-2026-121071
- CVE-2026-121207
- CVE-2026-121185
- CVE-2026-121166
- CVE-2026-121047
- CVE-2026-121124
- CVE-2026-121118
- CVE-2026-121188
- CVE-2026-121113
- CVE-2026-121082
- CVE-2026-121083
- CVE-2026-121179
- CVE-2026-121180
- CVE-2026-121181
- CVE-2026-121228
- CVE-2026-121080
- CVE-2026-121044
- CVE-2026-121051
- CVE-2026-121038
- CVE-2026-121090
- CVE-2026-121052
- CVE-2026-121037
- CVE-2026-121086
- CVE-2026-121131
- CVE-2026-121087
- CVE-2026-121178
- CVE-2026-121100
- CVE-2026-121148
- CVE-2026-121089
- CVE-2026-121250
- CVE-2026-121032
- CVE-2026-121114
- CVE-2026-121127
- CVE-2026-121210
- CVE-2026-121057
- CVE-2026-121201
- CVE-2026-121084
- CVE-2026-121094
- CVE-2026-121079
- CVE-2026-121143
- CVE-2026-121097
- CVE-2026-121214
- CVE-2026-121133
- CVE-2026-121249
- CVE-2026-121213
- CVE-2026-121241
- CVE-2026-121224
- CVE-2026-121117
- CVE-2026-121123
- CVE-2026-121182
- CVE-2026-121061
- CVE-2026-121227
- CVE-2026-121226
- CVE-2026-121068
- CVE-2026-121137
- CVE-2026-121160
- CVE-2026-121036
- CVE-2026-121104
- CVE-2026-121034
- CVE-2026-121208
- CVE-2026-121129
- CVE-2026-121211
- CVE-2026-121078
- CVE-2026-121060
- CVE-2026-121076
- CVE-2026-121221
- CVE-2026-121119
- CVE-2026-121244
- CVE-2026-121242
- CVE-2026-121105
- CVE-2026-121237
- CVE-2026-121102
- CVE-2026-121120
- CVE-2026-121161
- CVE-2026-121062
- CVE-2026-121031
- CVE-2026-121063
- CVE-2026-121108
- CVE-2026-121199
- CVE-2026-121099
- CVE-2026-121196
- CVE-2026-121066
- CVE-2026-121256
- CVE-2026-121115
- CVE-2026-121234
- CVE-2026-121177
- CVE-2026-121193
- CVE-2026-121248
- CVE-2026-121106
- CVE-2026-121200
- CVE-2026-121039
- CVE-2026-121122
- CVE-2026-121219
- CVE-2026-121255
- CVE-2026-121231
- CVE-2026-121183
- CVE-2026-121072
- CVE-2026-121103
- CVE-2026-121136
- CVE-2026-121040
- CVE-2026-121030
- CVE-2026-121075
- CVE-2026-121220
- CVE-2026-121170
- CVE-2026-121059
- CVE-2026-121163
- CVE-2026-121088
- CVE-2026-121033
- CVE-2026-121254
- CVE-2026-121065
- CVE-2026-121171
- CVE-2026-121116
- CVE-2026-121239
- CVE-2026-121187
- CVE-2026-121132
- CVE-2026-121067
- CVE-2026-121096
- CVE-2026-121184
- CVE-2026-121215
- CVE-2026-121212
- CVE-2026-121194
- CVE-2026-121202
- CVE-2026-121048
- CVE-2026-121070
- CVE-2026-121257
- CVE-2026-121218
- CVE-2026-121164
- CVE-2026-121223
- CVE-2026-121186
- CVE-2026-121176
- CVE-2026-121128
- CVE-2026-121216
- CVE-2026-121158
- CVE-2026-121110
- CVE-2026-121042
- CVE-2026-121238
- CVE-2026-121077
- CVE-2026-121245
- CVE-2026-121049
- CVE-2026-121091
- CVE-2026-121167
- CVE-2026-121135
- CVE-2026-121209
- CVE-2026-121134
- CVE-2026-121217
- CVE-2026-121109
- CVE-2026-121243
- CVE-2026-121053
- CVE-2026-121190
- CVE-2026-121125
- CVE-2026-121046
- CVE-2026-121222
- CVE-2026-121157
- CVE-2026-121235
- CVE-2026-121252
- CVE-2026-121168
- CVE-2026-121043
- CVE-2026-121111
- CVE-2026-121138
- CVE-2026-121055
- CVE-2026-121101
- CVE-2026-121236
- CVE-2026-121165
- CVE-2026-121253
- CVE-2026-121172
- CVE-2026-121206
- CVE-2026-121189
- CVE-2026-121121
- CVE-2026-121130
- CVE-2026-121251
- CVE-2026-121085
- CVE-2026-121159
- CVE-2026-121204
- CVE-2026-121205
- CVE-2026-121050
- CVE-2026-121081
- CVE-2026-121240
- CVE-2026-121198
- CVE-2026-121225
- CVE-2026-121162
- CVE-2026-121045
- CVE-2026-121029
- CVE-2026-121054
- CVE-2026-121175
- CVE-2026-121092
- CVE-2026-121073
- CVE-2026-121230
- CVE-2026-121093
- CVE-2026-121041
- CVE-2026-121232
- CVE-2026-121142
- CVE-2026-121069
- CVE-2026-121169
- CVE-2026-121064
- CVE-2026-121195
- CVE-2026-121141
Frequently Asked Questions
1
What attacker access is required for exploitation?
The attacker must first compromise the renderer process. Exploitation also requires the victim to interact with a crafted HTML page.
2
What is the potential impact after successful exploitation?
A successful attacker could potentially execute arbitrary code outside the browser sandbox. The stated impacts include high confidentiality, integrity, and availability effects.
3
Which versions are affected?
Google Chrome versions prior to 157.0.8103.38 are affected. The listed software also includes Debian Chromium, but no fixed Debian package version is provided.