CVE-2026-121199 in Chrome
Summary
by MITRE • 11/03/2026
Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as missing authorization within the Chromium-based chromoting component of Google Chrome represents a significant access control failure that affects macOS systems prior to version 157.0.8103.38. This flaw stems from an insufficient verification mechanism when handling local inter-process communication or API calls related to remote desktop functionality. In typical web browser architectures, components like chromoting are designed to facilitate connections between the browser and external services or devices. However, in this specific instance, the implementation failed to enforce strict authorization checks on requests originating from locally running programs. This oversight allows any process with local execution privileges on the victim's machine to interact with the chromoting service without proper authentication or permission validation. The severity of this issue is classified as medium by the Chromium security team, indicating that while it does not allow for immediate remote code execution, it poses a tangible risk to data confidentiality and system integrity through unauthorized information access.
From a technical perspective, the core defect lies in the absence of robust identity verification or capability checks before processing commands intended for chromoting operations. When a local program initiates an interaction with this component, the browser does not adequately verify whether the calling process has been granted explicit permission to perform such actions. This lack of enforcement creates a pathway for privilege escalation at the application level, where a lower-privileged malicious actor or malware can exploit the trust relationship between the user session and the browser engine. By leveraging this gap, an attacker can potentially retrieve sensitive data that is normally protected by standard sandboxing mechanisms. The impact extends beyond simple data leakage; it undermines the fundamental security model of the operating system which relies on strict isolation boundaries to prevent lateral movement within a compromised environment.
The operational impact of this vulnerability centers on the potential for unauthorized information disclosure and subsequent exploitation chains. A local attacker who gains access to the target machine, whether through phishing, malware installation, or physical access, can utilize this flaw to extract sensitive user data stored by Chrome. This may include browsing history, saved passwords, cookies containing session tokens, or other personally identifiable information that is cached locally for convenience. Furthermore, because chromoting involves remote control capabilities, an attacker might attempt to manipulate the state of active browser sessions or intercept communications intended for legitimate remote desktop connections. The ability to obtain sensitive information via a local program means that even if network-based defenses are robust, the internal security posture remains compromised due to this unchecked local access vector.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) category CWE-269, which describes Improper Privilege Assignment or Control of Access to Resources by Untrusted Actors. It also maps to MITRE ATT&CK technique T1053, specifically the Scheduled Task/Job component when considering how local programs might be automated for persistent access, and more directly relates to data exfiltration techniques such as T1005 Data from Local System. The failure to validate authorization before processing requests is a classic example of broken access control that attackers frequently exploit in modern software ecosystems where components interact across trust boundaries without rigorous verification.
To mitigate the risks associated with this vulnerability, immediate action should be taken to update Google Chrome and all Chromium-based browsers on affected macOS systems to version 157.0.8103.38 or later. This patch includes the necessary code changes to enforce proper authorization checks within the chromoting module, ensuring that only authorized processes can initiate sensitive operations. Organizations should implement automated patch management solutions to ensure timely deployment of security updates across all endpoints. Additionally, administrators should review local user permissions and restrict execution privileges for untrusted applications where possible. Implementing application whitelisting policies can further reduce the attack surface by preventing unauthorized programs from interacting with critical system components like Chrome's chromoting service. Regular auditing of installed software and monitoring for unusual local process activity will also help in detecting potential exploitation attempts before significant damage occurs.