CVE-2026-121157 in Chrome
Summary
by MITRE • 11/03/2026
Incorrect authorization in Chromoting in Google Chrome prior to 157.0.8103.38 allowed a local attacker to bypass system access restrictions via a local program. (Chromium security severity: Low)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as an incorrect authorization flaw within the Chromium-based Chromoting component of Google Chrome prior to version 157.0.8103.38 represents a significant lapse in privilege management logic. This specific defect allows for the bypassing of system access restrictions, enabling local attackers to execute unauthorized operations that should be restricted by standard security policies. The core technical issue stems from insufficient validation checks within the Chromoting service when handling requests initiated by locally running programs. Instead of strictly enforcing identity and permission boundaries, the component fails to adequately verify whether the initiating process possesses the necessary privileges to perform specific actions or access sensitive resources. This oversight creates a pathway for local privilege escalation or unauthorized data exfiltration depending on the context in which Chromoting is invoked within the browser environment.
From an operational perspective, this vulnerability impacts the integrity of the user session and potentially the broader system if elevated permissions are involved. An attacker with local access to the machine can craft a malicious program that interacts with the Chrome Chromoting interface. By exploiting the authorization bypass, the attacker can trick the service into performing actions on their behalf without proper authentication or consent checks. This could lead to scenarios where sensitive browser data is accessed, remote control capabilities are misused for surveillance, or system configurations are altered in violation of administrative policies. The severity rating of Low by Chromium security reflects that while the flaw exists and is exploitable locally, it typically requires some level of pre-existing local access rather than being a remotely exploitable zero-day vector. However, even low-severity vulnerabilities can be chained with other flaws to achieve more severe outcomes such as full system compromise or persistent backdoor installation.
This vulnerability aligns closely with CWE-269, which classifies Improper Privilege Management, specifically where an actor obtains elevated privileges without proper authorization. It also maps to the MITRE ATT&CK framework under techniques related to Local Privilege Escalation and potentially Defense Evasion if used to bypass security monitoring tools that rely on standard access control mechanisms. The failure lies in the application layer's inability to correctly enforce role-based or mandatory access controls, allowing a lower-privileged entity to interact with higher-privileged services as if it were authorized. This is particularly critical for components like Chromoting which handle remote desktop and screen sharing functionalities, as these features inherently require deep system integration and broad permissions to function effectively.
Mitigation strategies primarily involve updating the browser software to version 157.0.8103.38 or later where this authorization logic has been corrected. Administrators should ensure that automatic updates are enabled for all Chrome installations within their environment to minimize exposure windows. For environments where immediate patching is not feasible, implementing strict application whitelisting can prevent unauthorized local programs from interacting with the Chromoting interface. Additionally, enforcing least-privilege principles by running user sessions and browser processes under restricted accounts reduces the potential impact of such a bypass. Security teams should also monitor for anomalous behavior indicative of chromoting service abuse, such as unexpected remote desktop connections or unusual process spawning patterns originating from Chrome-related binaries. Regular auditing of access control lists and reviewing logs for failed authorization attempts can further aid in detecting exploitation attempts before they result in significant damage.