CVE-2026-121232 in Chrome
Summary
by MITRE • 11/03/2026
Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as an incorrect authorization flaw within the core components of Google Chrome prior to version 157.0.8103.38 represents a significant breach in access control mechanisms, specifically affecting how local applications interact with browser resources. This issue stems from a failure to properly enforce permission boundaries between different software entities running on the same host system. In modern operating environments, particularly those utilizing sandboxing and privilege separation like Chrome OS or Windows/Linux with strict user isolation, such authorization errors can allow processes that should be restricted to access data they are not explicitly permitted to view. The severity is classified as low by Chromium security standards because it requires a specific set of conditions to be met for exploitation, primarily involving the presence of co-installed applications and successful social engineering tactics against the end user.
The technical nature of this flaw involves a lapse in validating whether an application requesting access to sensitive browser data or functionality has been granted the necessary privileges by the system administrator or the local user. When Chrome processes requests from external entities, it relies on manifest files, permission grants, and operating system-level security tokens to determine accessibility. In this instance, the validation logic failed to adequately check these credentials before allowing a co-installed application to retrieve sensitive information. This could include browsing history, saved passwords, cookies containing session identifiers, or other personally identifiable information stored within the browser profile. The flaw does not stem from a complex buffer overflow or memory corruption but rather from logical errors in the authorization workflow that governs inter-process communication and resource sharing.
Operationally, this vulnerability enables a local attacker to exploit social engineering techniques to trick a user into installing or activating a malicious co-installed application. Once such an application is present on the system, it can leverage the incorrect authorization logic to query Chrome for sensitive data without triggering standard security warnings or requiring elevated privileges that would alert the user. The impact of this information disclosure is potentially severe depending on the sensitivity of the stored credentials and session tokens. An attacker could use harvested cookies to hijack active sessions across various web services, effectively bypassing multi-factor authentication if it relies solely on cookie persistence rather than device binding. Alternatively, access to saved passwords or autofill data can lead to direct credential theft, facilitating further unauthorized access to financial accounts, corporate networks, or personal communications.
Mitigation strategies for this vulnerability focus primarily on software updates and user awareness training. The most effective immediate remediation is to upgrade Google Chrome to version 157.0.8103.38 or later, where the authorization checks have been corrected to properly validate permissions before granting access to sensitive data. Organizations should enforce automated patch management policies to ensure that all endpoints are updated promptly upon the release of security fixes. Additionally, implementing strict application whitelisting can prevent unauthorized co-installed applications from running on corporate devices, thereby reducing the attack surface for local privilege escalation or information theft attacks.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, as it involves an actor obtaining privileges that they are not entitled to within the context of application interaction. It also relates to CWE-863, concerning Incorrect Authorization, where the software does not perform the correct authorization check for a critical action. In terms of offensive security frameworks like MITRE ATT&CK, this scenario maps to T1059, Command and Scripting Interpreter, if the co-installed app executes scripts to extract data, or more broadly to Data from Local System under the Collection tactic. The reliance on social engineering places it within the realm of human-factor exploitation, highlighting that technical controls must be complemented by robust user education regarding the risks of installing untrusted software.