Description
Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Published: 2026-11-03
Score: n/a
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

An uninitialized image resource in Google Chrome allows a remote attacker to retrieve cross‑origin data through a crafted HTML page. The flaw enables the disclosure of information across origin boundaries.

Affected Systems

Google Chrome desktop browsers older than version 157.0.8103.38 are affected.

Risk and Exploitability

The vulnerability is triggered by loading a specially crafted web page, making it exploitable from the Internet. No EPSS score is available and it is not listed in the CISA KEV catalogue, yet Chromium has rated it as a high‑severity issue, indicating that it could lead to significant data exposure if leveraged by an attacker.

Generated by OpenCVE AI on November 3, 2026 at 23:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Chrome to version 157.0.8103.38 or later.
  • Enable Chrome auto‑update to receive future security patches automatically.
  • If upgrading is not possible, restrict image loading from untrusted origins via enterprise policy or a content‑security policy to reduce exposure.

Generated by OpenCVE AI on November 3, 2026 at 23:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 23:45:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leak via Uninitialized Image Resource in Chrome

Tue, 03 Nov 2026 20:45:00 +0000

Type Values Removed Values Added
Description Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-908
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T20:42:33.742Z

Reserved: 2026-11-03T10:32:56.419Z

Link: CVE-2026-121213

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-03T21:17:30.717

Modified: 2026-11-03T21:17:30.810

Link: CVE-2026-121213

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T23:30:06Z

Weaknesses
  • CWE-908

    Use of Uninitialized Resource