EUVD-2026-116430
GHSA-q6c8-8mv6-7jfq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious site
-
DeliveryServe crafted HTML page
-
ExploitTrigger FileSystem authorization flaw
-
ExecutionEscape renderer sandbox
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim running Google Chrome desktop prior to 157.0.8103.38 to be socially engineered into visiting or opening an attacker-crafted HTML page (UI:R) - there is no authentication requirement (PR:N) and it works against default Chrome configurations. The limiting factor is the mandatory user interaction: the attacker cannot trigger it without luring the user to malicious web content, so it is not wormable or drive-by without that lure. The specific FileSystem feature/configuration abused and the exact authorization check that fails are not detailed in the available sources. |
| Impact | Multiple signals align toward genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction, and the changed scope (S:C) reflects a sandbox escape - the browser sandbox boundary is crossed to impact the host. The vendor-tagged Chromium severity is High and the vuln.today Decision label is act_now, and a vendor patch is already available, so remediation should be treated as urgent. Countervailing context: this is NOT listed in CISA KEV in the provided data, and no EPSS score was supplied, so there is no confirmation of active or widespread exploitation - the act_now urgency is driven by the severity, scope change, and patch availability rather than by observed in-the-wild use. The only exploit-adjacent reference is the Chromium issue tracker entry (issues.chromium.org/577400245), which is typically access-restricted and is NOT a working public exploit. CWE-863 (Incorrect Authorization) and the description ('Incorrect authorization in FileSystem') indicate an authorization logic flaw, which is more precise than the input's 'Authentication Bypass' tag; treat the mechanism as an authorization check failure in the FileSystem component, not a credential bypass. |
| Exploit ScenarioDerived | An attacker uses social engineering (phishing link, malicious ad, or compromised site) to lure a victim running a pre-157.0.8103.38 Chrome build into opening a crafted HTML page. The page abuses the FileSystem incorrect-authorization flaw to break out of the renderer sandbox and run attacker code in the host context. No public working exploit was identified; only a (typically restricted) Chromium bug-tracker reference exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Incorrect authorization in the FileSystem component of Google Chrome (all desktop versions prior to 157.0.8103.38) allows a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox, provided the victim is socially engineered into visiting or opening a crafted HTML page. The attack is not self-propagating: exploitation is gated entirely by the required user interaction (UI:R), but against a lured victim it works on default configurations and, per the CVSS scope-change metric, can compromise resources beyond Chrome's security boundary. Google rates the issue High and has released a stable-channel fix in 157.0.8103.38; no public exploit code has been identified at time of analysis, and the issue carries an act_now priority with a 9.6 CVSS score reflecting the sandbox escape potential.
RemediationAI
Vendor-released patch: update Google Chrome to 157.0.8103.38 or later via the stable channel; the fix is documented in the stable-channel release notes at https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html. Confirm the installed build reaches 157.0.8103.38 or higher on every managed endpoint, and push the version through your browser management tooling rather than relying on user-initiated updates, since exploitation only requires the victim to open a crafted HTML page. The supplied sources describe no workaround or feature-level mitigation, so updating is the only complete fix identified; organizations that cannot immediately deploy 157.0.8103.38 have no vendor-documented compensating control to fall back on beyond limiting exposure to untrusted web content, and the Chromium issue at https://issues.chromium.org/issues/577400245 should be monitored for any additional guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-863 (Incorrect Authorization), meaning a security-sensitive operation in Chrome's FileSystem code path is reachable without the caller holding the privileges or permission state it should require. Chrome's FileSystem surface straddles the browser-process privilege boundary - content in a renderer interacts with file-system brokering handled at higher privilege - so a missing or wrong authorization check there is what turns a renderer-side compromise into code execution outside the sandbox, which is why the CVSS vector carries S:C (scope change) alongside C:H/I:H/A:H. The vector AV:N/AC:L/PR:N/UI:R indicates the attack is network-delivered, requires no credentials, has no special attack complexity beyond the victim opening attacker-supplied HTML, and depends on that user interaction; the supplied sources do not detail which FileSystem feature or configuration is abused, nor the exact authorization check that fails, so the trigger mechanism beyond the crafted HTML page should be treated as unverified. Authentication requirements are unauthenticated per PR:N in the assessed vector.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered crafted HTML with no auth (AV:N/PR:N) but requiring the victim to open it (UI:R); sandbox escape crosses the trust boundary (S:C) enabling full code execution (C:H/I:H/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
2DescriptionCVE.org
Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 157.0.8103.38 contain a critical sandbox escape vulnerability (CVE-2026-121104) that allows remote, unauthenticated attackers to execute arbitrary code outside the browser's security boundary if a user is socially engineered into visiting a malicious webpage. This affects all desktop users and could lead to full system compromise, data theft, or malware installation, making it a priority for immediate remediation across the organization.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB