CVE-2026-121038
Description
An information leak flaw was found in the Compositing component of the Chromium browser.
Upstream bug(s):
Statement
Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to restrict rendering of untrusted web content to prevent cross-origin data exposure within the Compositing component: upgrade to Chromium 157.0.8103.38 (or the fixed Chromium builds), which fixes a cross-origin data leak in the Compositing component when rendering web pages, closing crafted HTML page. Until patched, this is a concern on Chromium and Google Chrome users viewing web content across all platforms, so avoid loading and viewing untrusted or attacker-controlled HTML pages in affected browser sessions. These controls limit blast radius and contain exploitation, but they do not fix the underlying cross-origin information leak defect — apply the upstream patch to fully remediate.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
