CVE-2026-121038 in Chrome
Summary
by MITRE • 11/03/2026
Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as an information leak within the compositing subsystem of Google Chrome represents a significant breach in browser isolation mechanisms, specifically affecting versions prior to 157.0.8103.38. This flaw stems from improper handling of cross-origin data during the rendering and composition phases of web content processing. In modern browsers like Chrome, the renderer process is responsible for parsing HTML, CSS, and JavaScript, while the browser process manages security policies such as the Same-Origin Policy (SOP). The compositing layer sits between these two, converting DOM trees into visual elements to be displayed on screen. When this subsystem fails to correctly enforce isolation boundaries, it can inadvertently expose sensitive data from one origin to another, allowing a remote attacker to bypass standard sandbox protections and access resources that should remain inaccessible under normal browsing conditions.
From a technical perspective, the root cause lies in how Chrome manages memory and state during the compositing pipeline. When a webpage is rendered, various layers are composited together to form the final image presented to the user. If there is a logic error or race condition within this process, particularly involving cross-origin iframes or mixed-content scenarios, sensitive information such as cookies, local storage data, or DOM content from a different origin can be leaked into the visual output or accessible via JavaScript APIs that interact with the rendering engine. This type of vulnerability exploits the trust relationship between the browser's security model and its performance optimizations, turning efficiency features into attack vectors for cross-origin data theft.
The operational impact of this vulnerability is severe due to its potential for remote exploitation without user interaction beyond visiting a maliciously crafted website. An attacker can host an HTML page designed specifically to trigger the compositing flaw, causing Chrome to expose sensitive information from other open tabs or previously visited sites within the same browser instance. This could lead to session hijacking, where stolen cookies allow attackers to impersonate users on web applications that rely solely on cookie-based authentication. Additionally, it may facilitate phishing attacks by revealing contextual data about a user's activities, such as email contents or financial details displayed in other tabs, thereby compromising privacy and potentially leading to further compromise of the victim's digital identity.
This incident aligns with Common Weakness Enumeration (CWE) category CWE-200: Information Exposure, which covers scenarios where sensitive information is disclosed without proper authorization controls. Furthermore, it maps to MITRE ATT&CK technique T1537: Data Transfer from Cloud Storage via Exfiltration over Alternative Protocol if the leak involves external data sources, but more accurately reflects T1005: Data from Local System when considering direct access to local browser storage and state. The severity is classified as High by Chromium security standards because it undermines the fundamental isolation guarantees that protect users against cross-site scripting and other web-based attacks.
Mitigation strategies primarily involve updating Google Chrome to version 157.0.8103.38 or later, where these compositing logic errors have been corrected through rigorous code review and patch deployment. For organizations managing large fleets of devices, automated update mechanisms should be prioritized to ensure all endpoints are protected against this specific flaw. Additionally, users can employ browser extensions that enforce stricter content security policies or disable JavaScript execution on untrusted sites as a temporary defensive measure until updates are applied. Security teams should also monitor for indicators of compromise related to unusual network traffic patterns originating from the browser process, which might indicate active exploitation attempts targeting older versions still in use within their environment.