Every CVESearch/Get API key

CVE-2026-121093

Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker...

5.7 Medium

CVE-2026-121093 is a medium vulnerability (CVSS 5.7) in Google Chrome, published November 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 9th percentile. No source names a fixed version.

What does this mean?
Severity
5.7 MediumCVSS 3.1, CVE List
Exploit chance
0.19%EPSS, 9th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.19%Unchanged since Nov 4, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
chromium
Debian:12
All versions, plus listed versions
113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1
Show 45 moreShow less
114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1
None known
chromium
Debian:13
All versions, plus listed versions
138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2
Show 45 moreShow less
139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1142.0.7444.175-1~deb12u1142.0.7444.175-1~deb13u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1143.0.7499.109-1
None known
chromium
Debian:14
All versions, plus listed versions
138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2
Show 45 moreShow less
139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1142.0.7444.175-1~deb12u1142.0.7444.175-1~deb13u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1143.0.7499.109-1
None known
chromium
openSUSE:Tumbleweed
From an advisory covering 213 CVEs
before 157.0.8103.38-1.1
157.0.8103.38-1.1
chromium
openSUSE:Leap 16.1
From an advisory covering 975 CVEs
before 157.0.8103.38-bp161.1.1
157.0.8103.38-bp161.1.1
gn
openSUSE:Leap 16.1
From an advisory covering 975 CVEs
before 0.20260928-bp161.1.1
0.20260928-bp161.1.1

What each source reports

CVE List Score used5.7

Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Record
CVE-2026-121093
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-125
Updated
2026-11-09
EUVDEUVD-2026-1163615.7

Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Record
EUVD-2026-116361
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-09
GitHub AdvisoriesGHSA-pjjj-qwm2-fv545.7

Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker...

Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Record
GHSA-pjjj-qwm2-fv54
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-125
Updated
2026-11-09
NVD5.7

Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Record
CVE-2026-121093
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-125
Updated
2026-11-09
OSVDEBIAN-CVE-2026-1210935.7

Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Record
DEBIAN-CVE-2026-121093
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-10
OSVopenSUSE-SU-2026:12426-1No score

chromedriver-157.0.8103.38-1.1 on GA media

These are all security issues fixed in the chromedriver-157.0.8103.38-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12426-1
Updated
2026-11-06
OSVopenSUSE-SU-2026:22323-1No score

Security update for chromium, gn

This update for chromium, gn fixes the following issues:

Changes in chromium:

  • Chromium 157 (157.0.8103.38) promoted to stable (boo#1289268):
    • CVE-2026-121156: Buffer overflow in Dawn
    • CVE-2026-121229: Memory corruption in ANGLE
    • CVE-2026-121246: Use after free in WebGL
    • CVE-2026-121035: Use after free in Prerender
    • CVE-2026-121247: Buffer overflow in Dawn
    • CVE-2026-121203: Use after free in Geometry
    • CVE-2026-121126: Use after free in Core
    • CVE-2026-121107: Incorrect authorization in BackgroundFetch
    • CVE-2026-121197: Out of bounds read in ANGLE
    • CVE-2026-121112: Out of bounds read in Permissions
    • CVE-2026-121174: Missing authorization in BackgroundFetch
    • CVE-2026-121098: Improper state validation in GPU
    • CVE-2026-121074: Memory corruption in GPU
    • CVE-2026-121173: Uninitialized resource in WebGL
    • CVE-2026-121233: Type confusion in CacheStorage
    • CVE-2026-121140: Out of bounds read in Internals
    • CVE-2026-121095: Uninitialized resource in WebGL
    • CVE-2026-121071: Incorrect authorization in FileSystem
    • CVE-2026-121207: Uninitialized resource in Dawn
    • CVE-2026-121185: Use after free in PictureInPicture
    • CVE-2026-121166: Type confusion in PDFium
    • CVE-2026-121047: Buffer overflow in Media
    • CVE-2026-121124: Improper adherence to coding standards in XML
    • CVE-2026-121118: Use after free in SVG
    • CVE-2026-121188: Use after free in PerformanceAPIs
    • CVE-2026-121113: Buffer overflow in PDFium
    • CVE-2026-121082: Type confusion in V8
    • CVE-2026-121083: Use after free in Compositing
    • CVE-2026-121179: Use after free in PDFium
    • CVE-2026-121180: Buffer overflow in Media
    • CVE-2026-121181: Use after free in Editing
    • CVE-2026-121228: Type confusion in V8
    • CVE-2026-121080: Use after free in Codecs
    • CVE-2026-121044: Use after free in Layout
    • CVE-2026-121051: UI misrepresentation in iOSWeb
    • CVE-2026-121038: Information leak in Compositing
    • CVE-2026-121090: Improper privilege management in Navigation
    • CVE-2026-121052: Use after free in GPU
    • CVE-2026-121037: Out of bounds write in ANGLE
    • CVE-2026-121086: Buffer overflow in Skia
    • CVE-2026-121131: Use after free in Mobile
    • CVE-2026-121087: Improper input validation in Mobile
    • CVE-2026-121178: Use after free in Aura
    • CVE-2026-121100: Use after free in DOM
    • CVE-2026-121148: Use after free in ANGLE
    • CVE-2026-121089: Use after free in WebGPU
    • CVE-2026-121250: Use after free in Extensions
    • CVE-2026-121032: Out of bounds read in Skia
    • CVE-2026-121114: Use after free in TabStrip
    • CVE-2026-121127: Use after free in WebAudio
    • CVE-2026-121210: Type confusion in V8
    • CVE-2026-121057: Type confusion in V8
    • CVE-2026-121201: Use after free in Animation
    • CVE-2026-121084: Out of bounds read in Skia
    • CVE-2026-121094: Type confusion in V8
    • CVE-2026-121079: Race condition in V8
    • CVE-2026-121143: Uninitialized resource in GPU
    • CVE-2026-121097: Use after free in Printing
    • CVE-2026-121214: Use after free in Passwords
    • CVE-2026-121133: Incorrect reference resolution in Images
    • CVE-2026-121249: Buffer overflow in ANGLE
    • CVE-2026-121213: Uninitialized resource in Images
    • CVE-2026-121241: Use after free in Navigation
    • CVE-2026-121224: Security issue in Desktop
    • CVE-2026-121117: Use after free in Paint
    • CVE-2026-121123: Use after free in Canvas
    • CVE-2026-121182: Use after free in DOM
    • CVE-2026-121061: Use after free in Modularization
    • CVE-2026-121227: Uninitialized resource in Skia
    • CVE-2026-121226: Type confusion in V8
    • CVE-2026-121068: Type confusion in V8
    • CVE-2026-121137: Type confusion in DevTools
    • CVE-2026-121160: Out of bounds read in Skia
    • CVE-2026-121036: Use after free in CSS
    • CVE-2026-121104: Incorrect authorization in FileSystem
    • CVE-2026-121034: Use after free in Views
    • CVE-2026-121208: Out of bounds read in Media
    • CVE-2026-121129: Use after free in WebRTC
    • CVE-2026-121211: Use after free…
Record
openSUSE-SU-2026:22323-1
Updated
2026-11-14

History

History
RecordedChangedSources
affected, aliases, referencesOSV
referencesEUVD, GitHub Advisories, NVD
severityCVE List
affected, aliases, referencesNVD, OSV
affected, aliases, referencesEUVD, NVD, OSV
aliases, products, published, referencesCVE List, EUVD
first indexedGitHub Advisories

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 718 versions, 789 references and the rest of 1 source description. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open