CVE-2026-121111 in Chrome
Summary
by MITRE • 11/03/2026
Incorrect authorization in HID in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified as an incorrect authorization issue within the Hardware Interface (HID) subsystem of Google Chrome prior to version 157.0.8103.38 represents a significant flaw in how browser permissions are validated when interacting with external hardware devices. This specific weakness allows a remote attacker, through the delivery of a maliciously crafted HTML page, to bypass system access restrictions that are normally enforced by the operating system and the browser's security sandbox. The core technical failure lies in the insufficient validation of user consent or permission states before granting the web application access to HID-connected peripherals such as keyboards, mice, game controllers, or other input devices. By exploiting this gap, an attacker can execute code within the context of a trusted hardware interface without proper authorization, effectively circumventing the intended security boundaries designed to protect user privacy and system integrity.
From a technical perspective, this vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically in contexts where access control checks are bypassed due to logic errors or missing validation steps. The attack vector is classified as remote via the network (ATT&CK T1059), leveraging social engineering tactics such as phishing emails or compromised websites that host the malicious HTML payload. When a user visits this crafted page, the script attempts to initialize communication with HID devices connected to the victim's machine. Due to the authorization flaw, the browser fails to correctly verify whether the current origin has been explicitly granted permission by the user for this specific hardware interaction. Consequently, the attacker gains unauthorized access to input events generated by these peripherals, which can be used to capture keystrokes, monitor mouse movements, or inject synthetic inputs into applications running on the host system.
The operational impact of this vulnerability is primarily centered around privacy violations and potential further exploitation through keylogging or session hijacking if combined with other vulnerabilities. Although Chromium classified the security severity as Low, indicating that the exploit complexity might be high or the immediate systemic risk limited by default browser settings, the ability to bypass access restrictions remains a critical concern for users who interact with sensitive data via HID devices. An attacker could potentially record sensitive information such as passwords, credit card numbers, or proprietary business communications entered through connected keyboards. Furthermore, if the compromised input stream is fed into other applications that do not adequately sanitize incoming events, it could lead to broader system compromise or unauthorized actions performed under the user's identity.
Mitigation strategies for this vulnerability involve immediate updates and configuration adjustments. The primary remediation step is to upgrade Google Chrome to version 157.0.8103.38 or later, where the authorization logic in the HID interface has been corrected to enforce strict permission checks before allowing web pages to interact with hardware devices. Administrators should ensure that automatic updates are enabled for all endpoints within their network to prevent exposure during the window between vulnerability disclosure and patch deployment. Additionally, users can mitigate risk by disabling unnecessary permissions for websites through Chrome's site settings, specifically revoking access to device information or sensors where not explicitly required. Implementing strict Content Security Policies (CSP) on web applications served from internal domains can also help reduce the attack surface by preventing unauthorized scripts from executing in contexts that might attempt such hardware interactions. Regular security audits and monitoring for unusual input patterns can further aid in detecting potential exploitation attempts of this nature.