CVE-2026-121103 in Chrome
Summary
by MITRE • 11/03/2026
Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as an incorrect authorization flaw within the extensions subsystem of Google Chrome, specifically affecting versions prior to 157.0.8103.38, represents a significant breach in browser-based access control mechanisms. This issue stems from a logical error or misconfiguration in how the Chromium engine validates permissions for installed web extensions. In modern browsers like Chrome, extensions operate within a sandboxed environment with specific privilege levels defined by their manifest files and user-granted consent. The flaw allows an attacker to bypass these intended restrictions, effectively elevating privileges beyond what was authorized for that particular extension context. This type of vulnerability is critical because it undermines the fundamental trust model between the browser engine and its add-on ecosystem, which relies on strict isolation boundaries to prevent malicious or compromised extensions from accessing sensitive user data across different origins.
From a technical perspective, this flaw likely involves a failure in the permission checking logic when an extension attempts to access resources belonging to another origin. Normally, cross-origin requests are subject to Same-Origin Policy restrictions unless explicitly permitted by CORS headers or specific API calls that require elevated privileges such as host permissions. The vulnerability suggests that the browser failed to properly verify whether the requesting extension possessed the necessary authorization for the target resource. Consequently, a crafted Chrome extension could exploit this gap to read data from other websites where the user is authenticated, effectively bypassing standard security controls. This behavior aligns with CWE-269, which classifies Improper Privilege Management, and more specifically points toward issues related to access control failures in web applications as described by CWE-862, Missing Authorization. The severity of this flaw is rated as Medium within the Chromium project because while it does not typically allow for direct code execution or full system compromise on its own, it provides a powerful vector for data exfiltration and privacy violations that can be chained with other vulnerabilities to achieve more severe outcomes.
The operational impact of this vulnerability is primarily centered around unauthorized data access and potential session hijacking scenarios. An attacker who distributes a malicious extension through the Chrome Web Store or via side-loading could trick users into installing it, often under the guise of providing legitimate functionality such as ad blocking, password management, or productivity enhancements. Once installed, if the user visits any website where they are logged in, the vulnerable extension can silently fetch and exfiltrate sensitive information including cookies, local storage data, session tokens, or even page content from those cross-origin sites. This leads to severe privacy breaches and potential account compromise for end-users. The risk is amplified by the fact that users often grant broad permissions to extensions without fully understanding the implications, making them vulnerable to exploitation of such authorization flaws. In terms of threat modeling, this activity corresponds to ATT&CK technique T1530, Data from Local System, specifically involving data staging and exfiltration over a command and control channel if combined with network capabilities within the extension's code.
Mitigation for this vulnerability requires immediate action by both users and developers relying on Chrome extensions. The primary remediation is to update Google Chrome to version 157.0.8103.38 or later, where the authorization checks have been corrected to enforce strict adherence to permission boundaries. Users should regularly audit their installed extensions, removing any that are no longer needed or those from untrusted publishers. Developers creating extensions must ensure rigorous testing of access control logic, adhering strictly to the principle of least privilege by requesting only the minimum permissions necessary for functionality. Furthermore, implementing Content Security Policy headers and validating all cross-origin requests within extension code can provide additional layers of defense against similar exploitation attempts in future versions or related software components.