CVE-2026-121104 in Chrome
Summary
by MITRE • 11/03/2026
Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified as an incorrect authorization flaw within the FileSystem API of Google Chrome prior to version 157.0.8103.38 represents a significant breach in browser-based access control mechanisms. This issue stems from improper validation or enforcement of permissions when applications attempt to interact with local file systems through web APIs. In modern browsers, sandboxing is a critical security feature designed to isolate untrusted content, such as remote websites, from the underlying operating system and user data. When authorization checks are bypassed or incorrectly implemented within components like FileSystem, this isolation boundary is compromised, allowing malicious code executed in one context to access resources intended for another, more privileged context.
From a technical perspective, the flaw likely involves a race condition, logic error, or insufficient scope verification during file system operations initiated by web content. An attacker could craft an HTML page that exploits these weaknesses to request elevated privileges or access files outside the designated sandboxed directory structure. By leveraging social engineering techniques, such as convincing a user to visit a malicious site or interact with specific UI elements, the attacker can trigger this unauthorized access path. Once triggered, the crafted code gains the ability to read sensitive local files or potentially write data into restricted areas of the file system, effectively escaping the browser's security sandbox.
The operational impact of this vulnerability is severe due to its potential for arbitrary code execution and data exfiltration. Although the description notes that remote exploitation requires social engineering, which limits fully automated attacks, it still poses a high risk in environments where users are prone to phishing or deceptive web interactions. Successful exploitation could lead to unauthorized access to personal documents, corporate secrets stored locally, or credential files. Furthermore, if the attacker can write to specific system directories or execute scripts via file manipulation, they may achieve persistent access or further lateral movement within the victim's environment, escalating from a simple data leak to full system compromise.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, as it involves granting capabilities beyond what is strictly necessary for the web content's intended function. It also maps closely to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically within the context of browser-based exploitation where scripts are used to interact with local resources. The attack vector falls under T1189, Drive-by Compromise, as it relies on a user visiting a malicious webpage without direct interaction beyond initial navigation or minimal engagement.
To mitigate this risk, organizations and users must ensure that Google Chrome is updated to version 157.0.8103.38 or later immediately upon availability. This patch addresses the underlying authorization logic errors within the FileSystem API implementation. Additionally, security teams should enforce strict Content Security Policies (CSP) to limit the sources from which scripts can execute and restrict file system access APIs where possible. User awareness training remains crucial for mitigating social engineering aspects of this threat, emphasizing caution when interacting with unfamiliar web content that requests unusual permissions or exhibits suspicious behavior. Regular auditing of browser configurations and disabling unnecessary experimental features related to local file access can further reduce the attack surface associated with such vulnerabilities.