CVE-2026-121223 in Chrome
Summary
by MITRE • 11/03/2026
Observable discrepancy in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as an observable media discrepancy within the Chromium-based browser engine, specifically affecting versions of Google Chrome prior to 157.0.8103.38, represents a significant cross-origin data leakage risk. This flaw stems from improper handling of multimedia resources during their rendering and processing phases. When a user navigates to or interacts with a maliciously crafted HTML page, the browser's media pipeline fails to correctly enforce isolation boundaries between different origins. Instead of treating media elements originating from untrusted domains as isolated entities, the implementation allows certain metadata, timing information, or state changes associated with these resources to be observable by scripts running in the context of the embedding origin. This discrepancy effectively creates a side-channel through which sensitive cross-origin data can be exfiltrated without direct access to the DOM content itself.
From a technical perspective, this issue is classified under CWE-200 as an Information Exposure vulnerability, specifically falling into categories related to timing attacks or observable state differences that reveal protected information. The attacker leverages this flaw by embedding media elements from target domains within their own controlled environment and then monitoring subtle behavioral deviations in the browser's response times or resource loading states. These deviations serve as indicators of whether specific content exists on the remote server, thereby allowing the construction of a fingerprinting mechanism or the confirmation of user-specific data such as browsing history or account status. This technique aligns with ATT&CK tactic T1078, Valid Accounts, and sub-technique T1564.002, Hidden Windows and Processes, where the attacker uses hidden browser contexts to gather intelligence without immediate detection by the end-user.
The operational impact of this vulnerability is primarily centered on privacy erosion and potential account takeover scenarios when combined with other attack vectors. By successfully exploiting this media discrepancy, a remote attacker can determine if a specific user has visited certain websites or possesses access to particular online services. In environments where single sign-on mechanisms are prevalent, confirming the existence of an active session for a target domain could facilitate further phishing attacks or credential stuffing attempts tailored to that specific service. Furthermore, in enterprise settings, this capability allows adversaries to map internal network structures by probing for resources accessible only from within trusted networks, thereby expanding their reconnaissance footprint and increasing the likelihood of successful lateral movement after initial compromise.
Mitigation strategies must prioritize immediate software updates as the primary defense mechanism. Administrators should ensure that all endpoints are running Google Chrome version 157.0.8103.38 or later, where this media handling logic has been corrected to strictly isolate cross-origin resource states. In addition to patching, organizations should implement strict Content Security Policy directives that restrict the loading of external media resources and disable unnecessary browser features such as autoplay for untrusted origins. Deploying advanced threat protection solutions capable of detecting anomalous network requests associated with timing-based side-channel attacks can also provide an additional layer of defense. Regular security awareness training regarding suspicious web content remains essential to reduce the risk of users inadvertently triggering these crafted pages through social engineering tactics.