CVE-2026-121159 in Chrome
Summary
by MITRE • 11/03/2026
Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified as an incorrect authorization issue within the history management subsystem of Google Chrome prior to version 157.0.8103.38 represents a significant deviation from expected privilege boundaries in web application contexts. This flaw specifically affects how the browser handles access controls for browsing history data when interacting with external or crafted HTML pages. The core technical deficiency lies in the insufficient validation of authorization tokens or session states during requests to retrieve or manipulate historical navigation records. In a properly secured environment, any attempt by an untrusted origin to access sensitive user-specific metadata such as visited URLs must be strictly gated behind robust authentication checks that verify the requester's identity and permissions against the current security context. However, in this instance, the browser failed to enforce these restrictions adequately when processing requests initiated from maliciously constructed web pages. This oversight allows a remote attacker who can persuade a victim user to visit a specially crafted HTML page to exploit the lack of proper authorization checks. The attack vector relies heavily on social engineering tactics because it requires initial user interaction, typically in the form of clicking a link or loading a webpage that contains embedded scripts designed to trigger the vulnerable code path within the browser engine.
From an operational perspective, this vulnerability enables unauthorized access to browsing history data which is considered sensitive personal information under many privacy regulations and industry standards. The ability for a remote attacker to bypass system access restrictions means they can potentially harvest detailed records of a user's online activities without explicit consent or proper authentication mechanisms being satisfied by the browser itself. This could lead to severe privacy violations where attackers gain insights into financial transactions, medical inquiries, professional research, or other private interests based on the URLs visited and stored in history. The severity is classified as low within the Chromium security framework because it requires user interaction and does not allow for direct remote code execution or full system compromise. Nevertheless, the impact remains significant due to the sensitivity of the data exposed and the potential for further exploitation if this information is combined with other known vulnerabilities or used for targeted phishing campaigns. The attacker leverages social engineering to lower the victim's defenses, making them more likely to interact with malicious content that triggers the authorization bypass.
In terms of industry standard classifications, this vulnerability aligns closely with CWE-269 which denotes Improper Privilege Management and specifically relates to situations where an actor is able to perform actions beyond their intended permissions due to flawed access control logic. It also intersects with aspects of CWE-749 related to exposure of sensitive information to unauthorized actors through improper authorization checks in web applications. From a tactical standpoint, this behavior mirrors techniques found in the MITRE ATT&CK framework under Initial Access via Spearphishing Link or Drive-by Compromise where attackers use social engineering to deliver malicious payloads that exploit client-side software flaws. The exploitation chain typically involves hosting a crafted HTML page on a server controlled by the attacker and enticing the victim through email, instant messaging, or other communication channels to visit the site. Once loaded, the embedded script attempts to query the browser's history API without satisfying all required authorization criteria due to the identified flaw in Chrome’s implementation.
Mitigation strategies for this vulnerability primarily involve updating Google Chrome to version 157.0.8103.38 or later where these authorization checks have been corrected and strengthened. Organizations should ensure that endpoint protection solutions are configured to detect unusual network traffic patterns associated with known exploit kits targeting browser vulnerabilities. User awareness training is critical in this context since the attack relies on social engineering; employees and users must be educated about the risks of visiting untrusted websites or clicking suspicious links even if they appear benign. Additionally, implementing strict Content Security Policies can help mitigate some aspects of cross-origin data leakage by restricting how scripts interact with browser APIs. Regular patch management cycles are essential to address such vulnerabilities promptly as browsers frequently release updates that fix security flaws in core components like history handling and authorization logic. Monitoring for indicators of compromise related to known exploit frameworks targeting Chrome versions prior to the fixed build can also aid in early detection and response efforts within enterprise environments.