CVE-2026-121198 in Chrome
Summary
by MITRE • 11/03/2026
Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as a confused deputy flaw within the WebUI component of Google Chrome prior to version 157.0.8103.38 represents a significant breach in browser isolation mechanisms, specifically targeting the web origin policy. This class of vulnerability arises when an application grants access to resources or functions based on identity rather than authorization context, allowing a lower-privilege entity to perform actions as a higher-privilege entity without proper validation. In this specific instance, the flaw resides within the internal WebUI interface that Chrome uses for managing its own settings and configuration pages. While these interfaces are generally intended for local user interaction, certain APIs or endpoints exposed through them may inadvertently allow cross-origin requests if not strictly gated by origin checks. The severity is classified as low because exploitation requires active user participation, yet it remains critical due to the potential for privilege escalation within the browser sandbox environment.
The technical mechanism behind this vulnerability involves a failure in strict origin validation during API calls made from external web pages into Chrome's internal WebUI components. Typically, browsers enforce same-origin policies to prevent malicious websites from reading sensitive data or executing actions on behalf of users on other domains. However, if the WebUI endpoint fails to verify that the request originates from an expected trusted context, it may process commands intended for local administration as valid requests from a remote attacker's webpage. This allows a crafted HTML page hosted by a remote adversary to interact with Chrome’s internal settings or features in ways that bypass standard security boundaries. The confusion occurs because the browser treats the incoming web request similarly to a legitimate local UI interaction, effectively granting the external script elevated privileges within the application context without explicit user consent for those specific actions.
Exploitation of this vulnerability relies heavily on social engineering tactics rather than purely automated code execution. An attacker must lure a victim into visiting a specially crafted webpage that contains JavaScript designed to trigger the vulnerable WebUI endpoints. Once the victim loads the page, the malicious script attempts to interact with Chrome’s internal interfaces, leveraging the confused deputy flaw to bypass origin restrictions. The operational impact of this vulnerability includes potential unauthorized access to browser settings, modification of security configurations, or extraction of sensitive data that is typically protected by same-origin policies. Although the severity is rated low due to the requirement for user interaction and social engineering, successful exploitation could lead to a compromise of the browsing session integrity, potentially facilitating further attacks such as credential theft or persistent malware installation if combined with other vulnerabilities.
Mitigation strategies primarily involve updating Google Chrome to version 157.0.8103.38 or later, where these origin validation checks have been strengthened and corrected by Chromium developers. Security teams should ensure that all endpoints within the WebUI are rigorously tested for cross-origin request forgery patterns and that strict referrer policy enforcement is applied to internal interfaces. Additionally, users can mitigate risk by maintaining up-to-date browser versions and exercising caution when visiting untrusted websites, as social engineering remains a primary vector for this type of attack. From an industry standards perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and falls under the ATT&CK technique T1059 Command and Scripting Interpreter, where attackers use browser scripts to execute actions beyond their intended scope. Continuous monitoring for anomalous WebUI interactions and enforcing strict content security policies can further reduce exposure to such confused deputy scenarios in web-based applications.