CVE-2026-121116 in Chrome
Summary
by MITRE • 11/03/2026
Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified as missing authorization in Google Chrome for Android represents a critical failure in access control mechanisms within the WebView component prior to version 157.0.8103.38. This flaw specifically affects scenarios where an attacker has already achieved code execution or significant influence over the renderer process, which is typically isolated from higher-privilege processes such as the browser UI and network stack. The core technical deficiency lies in the insufficient validation of permissions when WebView interacts with system-level APIs or sensitive data stores. In a properly secured environment, even if an attacker compromises a low-privilege sandboxed context like a renderer process, they should be restricted from accessing privileged resources without explicit authorization checks. However, due to this oversight, a crafted HTML page hosted on a malicious website can exploit the WebView's interface to bypass these restrictions and retrieve sensitive information that was not intended for public or untrusted access.
From an operational perspective, this vulnerability allows for data exfiltration by remote attackers who have successfully tricked users into visiting a specially constructed webpage. The attack vector relies heavily on social engineering combined with technical exploitation of the browser's rendering engine. Once the user interacts with the malicious content, the renderer process executes code that leverages the missing authorization check to query internal states or data structures within Chrome for Android. This can lead to the leakage of cookies, session tokens, local storage contents, or other persistent data stored by web applications running in the WebView context. The severity is classified as medium because while it requires an initial compromise of the renderer process, which often involves exploiting a separate vulnerability such as a use-after-free or type confusion flaw, the resulting impact can be significant depending on the sensitivity of the accessed data and the user's activity within the browser session.
This incident aligns with CWE-269, Improper Authorization, where an actor is able to access resources or perform actions for which they should not have been granted privileges. Furthermore, it relates to ATT&CK technique T1059, Command and Scripting Interpreter, as the attacker utilizes scripting capabilities within the HTML page to execute the exploit logic against the browser's internal interfaces. The breach of isolation boundaries between the renderer process and sensitive system components undermines the fundamental security model of modern web browsers, which relies on strict sandboxing to contain damage from compromised websites.
Mitigation for this vulnerability requires immediate updates to Google Chrome for Android to version 157.0.8103.38 or later, where the authorization checks have been reinforced and access controls properly enforced within the WebView implementation. Security administrators should ensure that automatic update mechanisms are enabled on all corporate devices running affected versions of the browser to minimize exposure windows. Additionally, users can mitigate risk by employing strict content security policies in their own web applications if they utilize embedded WebViews, although this does not protect against third-party malicious sites exploiting the browser itself. Implementing additional layers of defense such as endpoint detection and response solutions that monitor for anomalous process behavior may also help detect exploitation attempts before data exfiltration occurs.