CVE-2026-121112 in Chrome
Summary
by MITRE • 11/03/2026
Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified as an out-of-bounds read within Google Chrome's permissions system prior to version 157.0.8103.38 represents a critical failure in memory safety controls that can lead to severe security consequences. This flaw resides in the component responsible for managing and validating permission states, which are essential for enforcing browser sandboxing policies. When an attacker crafts a malicious HTML page designed to exploit this specific logic error, they can trigger a read operation that accesses memory locations beyond the intended buffer boundaries. Although out-of-bounds reads typically result in information disclosure by allowing an attacker to leak sensitive data from adjacent memory regions, the Chromium security team has classified this issue with high severity due to its potential for code execution under specific conditions or when combined with other vulnerabilities within the renderer process environment.
The operational impact of this vulnerability is significant because it targets a remote attack vector that requires user interaction in the form of visiting a crafted webpage. However, the critical aspect lies in the prerequisite condition where the attacker has already compromised the renderer process. In modern browser architectures like Chromium, each tab or site runs in an isolated sandboxed environment known as the renderer process to prevent malicious code from accessing sensitive system resources or other tabs. By exploiting this out-of-bounds read within the permissions module, a threat actor who has achieved partial compromise of the renderer can potentially escape this isolation boundary. This escalation allows for arbitrary code execution outside the restrictive sandbox, effectively granting the attacker control over the user's environment with higher privileges than intended by the browser's security model.
From a technical classification perspective, this vulnerability aligns closely with CWE-125, which describes Out-of-Bounds Read vulnerabilities where software reads data past the end or before the beginning of the intended buffer. Furthermore, in the context of the MITRE ATT&CK framework, this exploit technique relates to T1059 Command and Scripting Interpreter within a sandbox escape scenario, specifically leveraging memory corruption flaws to break out of containerized execution environments. The ability to execute code outside the sandbox fundamentally undermines the core security principle of least privilege that browsers rely on to protect users from web-based threats.
Mitigation for this vulnerability primarily involves updating Google Chrome to version 157.0.8103.38 or later, where the underlying memory management logic in the permissions subsystem has been corrected to prevent invalid access patterns. Organizations should ensure automated patching mechanisms are active to maintain currency with security updates released by Chromium and its downstream consumers like Google Chrome. Additionally, users can reduce their exposure risk by employing browser hardening techniques such as disabling JavaScript for untrusted sites or using extensions that restrict permission requests, although these measures do not replace the necessity of applying vendor-provided patches. Regular auditing of browser versions across all endpoints is essential to close this specific attack vector and maintain a robust defense-in-depth posture against sophisticated web-based exploits.