Loading vulnerability…
Cross-Origin Information Disclosure in Google Chrome Core
CVE-2026-126878 is a high-severity information disclosure vulnerability in the Core component of Google Chrome before version 157.0.8103.78. A remote attacker can use a crafted HTML page to leak cross-origin data. The specific vulnerable function and underlying implementation defect are not publicly detailed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality of cross-origin data accessible through the vulnerability. The CVSS v3.0 assessment assigns high confidentiality impact and no integrity or availability impact. Code execution and privilege escalation are not established outcomes.
Patch, then assume compromise.
Upgrade Google Chrome to version 157.0.8103.78 or later and relaunch the browser to activate the update. The announced Stable releases are 157.0.8103.78/.79 for Windows and macOS and 157.0.8103.78 for Linux. Administrators should verify deployment across managed devices. A fixed Debian Chromium package version is not specified.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.