Chrome 157 fixes 83 flaws, including five critical use-after-free bugs
Windows and Mac move to 157.0.8103.78/.79 and Linux to 157.0.8103.78; the notice does not report exploitation.
72
Vulnerability1 · 1 read
CVE-2026-126862
Origin-policy bypass in Chrome for Android before 157.0.8103.78
- CVSS 3.1
- 7.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Improper input validation in Chrome’s Core component on Android lets a local attacker bypass web origin policy using a co-installed app. The attacker needs a malicious app already on the device; no remote or unauthenticated trigger is described. Successful use breaks same-origin isolation between web content. Android Chrome builds before 157.0.8103.78 are affected.
What to do: Update Google Chrome on Android to 157.0.8103.78 or later.
| Product | Affected | Fixed in |
|---|---|---|
| Google Chrome on Android | prior to 157.0.8103.78 | 157.0.8103.78 |
Estimated exposure
largeNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper input validation in Core in Google Chrome on on Android prior to 157.0.8103.78 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: High)
- Weakness
- CWE-20
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
In the news
2 storiesChrome 157 fixes 83 flaws, five critical use-after-frees
The Stable Channel update does not say these new flaws are being exploited; bug details may stay restricted.
68