CVE-2026-121142 in Chrome
Summary
by MITRE • 11/03/2026
Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified as an incorrect authorization issue within the network subsystem of Google Chrome prior to version 157.0.8103.38 represents a significant deviation from expected browser security boundaries, specifically concerning how extensions interact with web origins. This flaw allows for the bypassing of the Same-Origin Policy (SOP), which is a critical security mechanism designed to restrict documents or scripts loaded in one origin from interacting with resources from another origin. The severity of this vulnerability is classified as low by Chromium standards, indicating that while it compromises isolation principles, exploitation requires specific conditions and user interaction rather than being an automatic remote code execution vector.
The technical root cause lies in the improper validation of authorization checks when handling network requests initiated or manipulated through Chrome extensions. In a properly secured environment, any extension attempting to access resources across different origins must adhere strictly to permission scopes defined by its manifest file and validated against current security policies. However, due to this flaw, an attacker could craft a malicious Chrome extension that exploits the gap in authorization logic. This crafted extension would be able to send network requests or retrieve data from domains other than its own without triggering the expected cross-origin restrictions, effectively treating resources from different origins as if they belonged to the same origin.
Exploitation of this vulnerability relies heavily on social engineering tactics because it requires the victim user to install and enable a malicious extension within their browser environment. An attacker would typically distribute such an extension through unofficial channels or disguise it as legitimate software, convincing users to grant it necessary permissions. Once installed, the extension can leverage its elevated privileges relative to standard web pages to perform actions that should be prohibited by the sandboxing model of the browser. This includes reading sensitive data from other websites, posting content on behalf of the user without consent, or intercepting and modifying network traffic intended for different origins.
The operational impact of this vulnerability centers around potential data exfiltration and session hijacking scenarios. By bypassing web origin policies, an attacker could access cookies, local storage contents, or API responses from other sites where the victim is authenticated. This capability undermines user privacy and can lead to account takeover if combined with other attack vectors such as cross-site scripting (XSS) on vulnerable third-party services. Furthermore, it allows for unauthorized actions performed under the identity of the logged-in user across various web platforms, compromising integrity and confidentiality guarantees provided by modern browsers.
Mitigation strategies primarily involve updating Google Chrome to version 157.0.8103.38 or later, where these authorization checks have been corrected to enforce strict origin validation for extension-based network operations. Users should also adopt best practices regarding browser extensions, such as installing only from the official Chrome Web Store and regularly auditing installed extensions to remove any that are no longer needed or appear suspicious. Security administrators can further mitigate risk by implementing content security policies (CSP) at an organizational level where applicable and educating users about the risks of granting broad permissions to third-party add-ons.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Authorization, as it involves failing to enforce proper access controls for network resources based on origin context. It also relates to ATT&CK technique T1059, Command and Scripting Interpreter, specifically through the use of browser extensions as a vehicle for executing malicious logic within the trusted environment of the web browser. Understanding these mappings helps in categorizing similar incidents during incident response activities and ensures that future patch management processes prioritize fixes affecting core security boundaries like origin isolation mechanisms.