Live › vulnerability › CVE-2026-121060
Google Chrome versions before 157.0.8103.38 have an incorrect authorization flaw in the FileSystem component. A remote attacker who tricks a user into opening a crafted HTML page could potentially execute arbitrary code outside the browser sandbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running Google Chrome older than 157.0.8103.38 is exposed, because the flaw is in the browser itself and is triggered by visiting a crafted HTML page. Exploitation depends on social engineering, so the user has to be lured to the page. Systems with Chrome already at or above the fixed version are not affected.
No product ranges from the sources yet.
157.0.8103.38 are affected.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-121060")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.