CVE-2026-121039 in Chrome
Summary
by MITRE • 11/03/2026
Incorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as incorrect authorization within the proxy authentication mechanism of Google Chrome versions prior to 157.0.8103.38 represents a significant flaw in how the browser validates credentials when interacting with intermediate network infrastructure. This issue stems from a logic error or insufficient validation check during the handshake process between the client and an HTTP or HTTPS proxy server. In standard web browsing, proxies often require authentication to control access, log usage, or enforce security policies. When Chrome fails to correctly verify that the provided authorization credentials are valid for the specific request context or session state, it may proceed with transmitting sensitive data even when proper authentication has not been established or has expired. This breakdown in the trust boundary allows an attacker positioned within the same local network segment to exploit this misconfiguration.
An adjacent attacker, typically defined as someone who shares a physical or logical network infrastructure such as a Wi-Fi hotspot, corporate LAN, or public internet exchange point without needing prior system access, can leverage this flaw through crafted network traffic. By intercepting and manipulating HTTP requests destined for proxy servers, the adversary can craft packets that bypass standard authentication checks. This capability enables the attacker to perform man-in-the-middle attacks where they can observe, modify, or inject content into unencrypted web sessions. Even in cases involving encrypted connections, if the initial connection setup relies on clear-text negotiation with a misconfigured proxy, sensitive headers and metadata may be exposed before encryption is fully established or maintained correctly throughout the session.
The operational impact of this vulnerability centers on the compromise of confidentiality for users browsing within affected network environments. Sensitive information such as personal identifiers, financial details, login credentials transmitted over non-HTTPS endpoints, and proprietary corporate data can be harvested by the attacker. This exposure violates the fundamental security principle that authentication mechanisms must reliably enforce access control policies. The severity is classified as medium because while it does not allow for arbitrary code execution or direct system compromise on the client device, it facilitates significant privacy breaches and potential credential theft which serves as a foothold for further attacks like session hijacking or phishing campaigns using manipulated content injected into the traffic stream.
From an industry standards perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically where access control decisions are not properly enforced during authentication processes. It also relates to CWE-306 Missing Authentication for Critical Function if the proxy interaction is considered a critical security function that requires strict validation. In terms of the MITRE ATT&CK framework, this exploit scenario maps to T1557 Adversary-in-the-Middle, as it involves intercepting and potentially altering communications between two parties who believe they are directly communicating with each other but are actually being monitored by an intermediary attacker.
Mitigation strategies primarily involve updating Google Chrome to version 157.0.8103.38 or later where the authorization logic has been corrected to ensure that credentials are validated against current session states and proxy requirements before any sensitive data is transmitted. Users should also prioritize using HTTPS-only browsing modes whenever possible, as this reduces the attack surface for traffic interception regardless of proxy authentication flaws. Network administrators hosting internal proxies must ensure their configurations strictly enforce authentication checks and reject requests from unauthenticated clients to prevent exploitation by adjacent attackers on shared networks. Regular security audits of network infrastructure and browser configuration policies are essential to maintaining robust defense-in-depth against such authorization bypasses.