CVE-2026-121170 in Chrome
Summary
by MITRE • 11/03/2026
Improper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as an improper resource control issue within the WebCodecs API of Google Chrome prior to version 157.0.8103.38 represents a significant deviation from expected browser isolation boundaries. This flaw specifically impacts the mechanism by which web origins are isolated, allowing for potential cross-origin data leakage or unauthorized access to resources that should remain restricted to their originating context. The WebCodecs API is designed to provide high-performance encoding and decoding capabilities for media streams directly within the browser environment, but it relies heavily on strict adherence to same-origin policies to prevent malicious scripts from accessing sensitive content belonging to other domains. When this control fails, the security model that protects user privacy and data integrity is compromised at a fundamental level.
The technical root cause lies in how Chrome handles resource allocation and access permissions for media processing tasks initiated via WebCodecs. In a properly secured implementation, any operation involving codec instances must verify that the calling script belongs to an origin permitted to interact with the specific media resources being processed. The flaw allows a crafted HTML page hosted on one domain to manipulate these internal controls in such a way that it can bypass the expected restrictions. This typically involves exploiting race conditions or state management errors where the browser fails to correctly validate the origin of the request against the resource's access policy before granting execution privileges. Consequently, an attacker can construct a malicious webpage that tricks the browser into treating cross-origin media data as if it were same-origin, effectively neutralizing the protective barriers intended by the web platform security model.
From an operational perspective, this vulnerability enables remote attackers to perform unauthorized actions against users who visit the crafted page. The primary impact is the potential bypass of the Same-Origin Policy (SOP), which is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. By circumventing these restrictions, an attacker could potentially exfiltrate sensitive media data, such as video streams containing private information, or inject malicious code into contexts where it should not have access. This undermines the trust users place in their web browsers and exposes them to risks including session hijacking if combined with other vulnerabilities, or unauthorized surveillance through webcam or microphone stream interception if those resources are improperly accessed via the codec pipeline.
This incident aligns closely with CWE-200, which classifies information exposure vulnerabilities where sensitive information is disclosed without proper access controls. Furthermore, in terms of offensive security frameworks like MITRE ATT&CK, this behavior correlates with techniques used for data exfiltration over alternative protocols or through browser-based attacks that leverage legitimate system functionalities to bypass network defenses and application-level restrictions. The medium severity rating assigned by the Chromium team reflects the potential impact while acknowledging that exploitation requires specific user interaction, such as visiting a malicious site, rather than being fully automatic upon browsing any webpage.
To mitigate this risk, users must ensure their browsers are updated to version 157.0.8103.38 or later immediately after release. For organizations managing large fleets of devices, deploying automated patch management solutions is essential to minimize the window of exposure during which vulnerable versions remain in use. Additionally, implementing Content Security Policy (CSP) headers can provide an additional layer of defense by restricting the sources from which scripts and media resources are loaded, thereby reducing the attack surface even if a browser-level vulnerability exists. Developers should also audit their usage of WebCodecs to ensure that all resource handling adheres strictly to origin checks and avoids relying on implicit trust assumptions about the context in which codecs operate. Regular security audits and penetration testing focused on cross-origin interactions within media processing APIs can help identify similar implementation flaws before they are exploited in the wild.