CVE-2026-121195 in Chrome
Summary
by MITRE • 11/03/2026
Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as an incorrect authorization issue within the Trusted Types implementation of Google Chrome, specifically in versions prior to 157.0.8103.38, represents a significant deviation from expected security boundaries for web origin policies. Trusted Types is a browser feature designed to mitigate Cross-Site Scripting by enforcing strict content policy rules that restrict where HTML can be written and how scripts are executed. The flaw arises when the authorization checks governing these trusted type assignments fail to properly validate the context or permissions of the calling script, allowing a remote attacker to circumvent these safeguards through a specially crafted HTML page. This bypass effectively undermines the core purpose of Trusted Types, which is to prevent malicious code injection by ensuring that only explicitly allowed sources can perform dangerous DOM operations.
From a technical perspective, this flaw falls under the category of improper access control mechanisms where the browser's internal state management for trusted types does not correctly enforce isolation between different web origins. When an attacker constructs an HTML page containing specific payloads designed to exploit this logic error, they can trick the browser into treating untrusted or malicious content as a trusted type. This allows the execution of arbitrary JavaScript code within the context of the victim's origin, effectively breaking the same-origin policy that is fundamental to modern web security. The severity is classified as low by Chromium standards because while it allows for script injection, it typically requires user interaction with a crafted page and may be limited in scope compared to more critical memory corruption vulnerabilities, yet its impact on data integrity and confidentiality remains substantial.
The operational impact of this vulnerability centers on the potential for Cross-Site Scripting attacks that can lead to session hijacking, credential theft, or defacement of web applications relying on Trusted Types for protection. An attacker leveraging this flaw could inject malicious scripts into a victim's browsing session, potentially accessing sensitive data stored in local storage or cookies, manipulating page content, or performing actions on behalf of the user without their consent. This is particularly dangerous because it targets environments that have implemented additional layers of security through Trusted Types, giving administrators and developers a false sense of complete protection against XSS attacks when those protections are actually bypassed due to this authorization flaw.
To mitigate this risk, organizations must ensure that all instances of Google Chrome are updated to version 157.0.8103.38 or later where the underlying logic for Trusted Types authorization has been corrected. Developers should also review their implementation of Content Security Policy and Trusted Types configurations to ensure they adhere strictly to best practices defined by industry standards such as CWE-269, which covers improper privilege assignment, and align with ATT&CK technique T1059.004, specifically the JavaScript subtechnique for command and script interpretation. Regular security audits of web applications that utilize these features are recommended to verify that no custom implementations inadvertently introduce similar authorization gaps before they can be exploited by remote attackers seeking to bypass origin policies.