CVE-2026-121071 in Chrome
Summary
by MITRE • 11/03/2026
Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as an incorrect authorization flaw within the FileSystem API of Google Chrome prior to version 157.0.8103.38 represents a significant breach in browser-based access control mechanisms. This specific defect allows for unauthorized interactions with file system resources that should be strictly isolated from web content under normal security policies. The core issue lies in how the browser validates permissions when scripts attempt to read, write, or manipulate files through the File System Access API and related interfaces. Instead of enforcing strict origin-bound restrictions and user consent prompts as intended by the sandbox model, the flawed implementation permits certain operations without adequate verification of the caller's authority. This misconfiguration effectively weakens the boundary between untrusted web content and local system resources, creating a pathway for privilege escalation within the context of the browser process.
The operational impact of this vulnerability is severe due to its potential for remote code execution outside the sandbox environment. Attackers can leverage social engineering tactics to deceive users into visiting a maliciously crafted HTML page or clicking on deceptive links that trigger the vulnerable file system interactions. Once executed, the attacker's script gains the ability to access sensitive files stored on the user's device, such as documents, configuration files, or credentials, which are typically protected by the browser's same-origin policy and sandboxing restrictions. Furthermore, if the vulnerability allows for writing operations, it could potentially be used to overwrite critical system files or inject malicious content into legitimate applications, leading to full compromise of the host machine. The severity is classified as High because it bypasses fundamental security controls that are designed to prevent arbitrary code execution from untrusted sources.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, specifically regarding the failure to enforce proper authorization checks before granting access to protected resources. It also relates closely to CWE-732, as it involves incorrect permission assignments that allow actions beyond what is intended for the user or application context. In terms of offensive security frameworks, this exploit scenario maps directly to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, where attackers use scripts like JavaScript within a browser environment to execute commands on the target system. The social engineering aspect further connects it to T1566, Phishing, as initial access is often gained through deceptive user interaction rather than purely technical exploitation of network services.
Mitigation for this vulnerability requires immediate action by updating Google Chrome to version 157.0.8103.38 or later, where the authorization logic has been corrected to properly validate file system permissions against the requesting origin and user consent state. Administrators should enforce automatic update policies across all endpoints to ensure that users are protected against such browser-based exploits without manual intervention. Additionally, organizations can implement application control solutions like Microsoft AppLocker or Windows Defender Application Control to restrict the execution of scripts from temporary directories or untrusted locations, adding a layer of defense-in-depth even if the browser vulnerability is exploited. User awareness training remains critical in mitigating social engineering vectors that serve as the primary delivery mechanism for this type of attack, emphasizing caution when interacting with unfamiliar web content or downloading files from unverified sources.