CVE-2026-121169 in Chrome
Summary
by MITRE • 11/03/2026
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as missing authorization within the Developer Tools component of Google Chrome prior to version 157.0.8103.38 represents a significant deviation from expected access control mechanisms in browser-based development environments. This flaw specifically affects the privilege boundaries that separate standard web content from privileged browser interfaces, allowing for an unauthorized elevation of capabilities when specific conditions are met. The core technical issue lies in the insufficient validation of user intent and context during the initialization or interaction with DevTools features via extension APIs. In a properly secured environment, any attempt to access sensitive debugging interfaces should require explicit, verified authorization that confirms the legitimacy of the requestor and ensures it originates from an authorized source without coercion. However, due to this deficiency, the browser fails to adequately distinguish between legitimate developer actions and those induced by malicious actors through deceptive means.
The operational impact of this vulnerability is primarily realized through social engineering attacks rather than purely automated exploitation. A remote attacker can craft a malicious Chrome extension that appears benign or useful to the end-user but contains logic designed to trigger the vulnerable DevTools functionality. By leveraging techniques such as fake error messages, misleading permissions requests, or deceptive user interface elements, an attacker can persuade a victim to install and activate this extension. Once installed, the extension exploits the missing authorization check to bypass web origin policies. This allows the malicious code to access resources, data, or functionalities that are normally restricted by the same-origin policy, effectively breaking down the isolation boundaries that protect users from cross-site scripting attacks and unauthorized data exfiltration.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Assignment, as it involves granting elevated access to an actor without proper verification of their authority. Furthermore, the attack vector relates to ATT&CK technique T1059, Command and Scripting Interpreter, specifically through browser extensions, and potentially T1078, Valid Accounts, if the attacker tricks a user into authenticating or authorizing malicious behavior under false pretenses. The severity is rated as Low by Chromium security standards because it requires active user interaction and social engineering to succeed, rather than being an automatic remote code execution flaw. Nevertheless, its potential for data theft and session hijacking remains significant in targeted scenarios where users are less vigilant about extension permissions.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. The primary remediation is the immediate upgrade of Google Chrome to version 157.0.8103.38 or later, which addresses the authorization checks within the DevTools subsystem. For organizations managing large fleets of browsers, centralized deployment tools should be utilized to ensure rapid distribution of this update. Additionally, users and administrators should adopt a principle of least privilege regarding browser extensions by regularly auditing installed add-ons and removing those that are no longer necessary or have excessive permissions. Security awareness training is also critical in this context, as educating end-users about the risks of installing unverified extensions and recognizing social engineering tactics can significantly reduce the success rate of such attacks. Implementing strict Content Security Policies for internal web applications can further limit the damage if an origin bypass occurs by restricting how scripts interact with external resources or privileged interfaces.