{"id":"CVE-2026-121060","kind":"vulnerability","aliases":["CVE-2026-121060"],"related":[],"title":"Chrome: FileSystem authorization flaw lets crafted pages run code outside sandbox","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"Google Chrome versions before 157.0.8103.38 have an incorrect authorization flaw in the FileSystem component. A remote attacker who tricks a user into opening a crafted HTML page could potentially execute arbitrary code outside the browser sandbox.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","desktop","linux","macos","package","windows"],"not_affected_if":["chrome-updated"],"how_to_check":"- Open Chrome and check the version under Settings > About Chrome; versions below `157.0.8103.38` are affected.","fix":"- Google Chrome: move to `157.0.8103.38` or later.","status":"open","published_at":"2026-11-03T21:17:10+00:00","first_seen_at":"2026-11-03T21:19:10+00:00","triaged_at":"2026-11-03T21:27:08+00:00","updated_at":"2026-11-03T21:27:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T21:27:08Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: move to `157.0.8103.38` or later.","reach":"internet","title":"Chrome: FileSystem authorization flaw lets crafted pages run code outside sandbox","impact":"high","summary":"Google Chrome versions before 157.0.8103.38 have an incorrect authorization flaw in the FileSystem component. A remote attacker who tricks a user into opening a crafted HTML page could potentially execute arbitrary code outside the browser sandbox.","audience":"everyone","category":"package","nicknames":[],"who_cares":["chrome","browser","desktop","windows","macos","linux"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs arbitrary code outside the browser sandbox after a lure","analyst_note":"","how_to_check":"- Open Chrome and check the version under Settings > About Chrome; versions below `157.0.8103.38` are affected.\n- unknown for managed or enterprise fleets beyond checking the installed Chrome version.","plain_action":"Update Google Chrome to version 157.0.8103.38 or later: Chrome menu > Help > About Google Chrome.","needs_analyst":false,"not_affected_if":["chrome-updated"],"who_is_affected":"Anyone running Google Chrome older than 157.0.8103.38 is exposed, because the flaw is in the browser itself and is triggered by visiting a crafted HTML page. Exploitation depends on social engineering, so the user has to be lured to the page. Systems with Chrome already at or above the fixed version are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4119,"output_tokens":585,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121060':14A,17A '-2026':13A,16A '157.0.8103.38':29B,70C 'allow':71C 'arbitrari':55B,81C 'attack':41B,74C 'author':3A,33B,62C 'browser':18B,59B 'chrome':1A,19B,26B,67C 'chromium':91C 'code':9A,56B,82C 'compon':38B 'could':52B 'craft':6A,49B,88C 'cve':12A,15A 'desktop':20B 'engin':77C 'execut':54B,80C 'filesystem':2A,37B,64C 'flaw':4A,34B 'googl':25B,66C 'high':94C 'html':50B,89C 'incorrect':32B,61C 'let':5A 'leverag':75C 'linux':21B 'maco':22B 'open':47B 'outsid':10A,57B,83C 'packag':23B 'page':7A,51B,90C 'potenti':53B,79C 'prior':68C 'remot':40B,73C 'run':8A 'sandbox':11A,60B,85C 'secur':92C 'sever':93C 'social':76C 'trick':43B 'user':45B 'version':27B 'via':86C 'window':24B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Google Chrome older than 157.0.8103.38 is exposed, because the flaw is in the browser itself and is triggered by visiting a crafted HTML page. Exploitation depends on social engineering, so the user has to be lured to the page. Systems with Chrome already at or above the fixed version are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.38 or later: Chrome menu > Help > About Google Chrome.","pkeys":[],"ptokens":[],"labels":["browser","chrome","desktop","high","linux","macos","package","windows"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121060","severity":null,"published_at":"2026-11-03T21:17:10+00:00","modified_at":"2026-11-03T21:17:10+00:00","first_seen_at":"2026-11-03T21:19:10+00:00","fetched_at":"2026-11-03T21:19:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}