{"id":"CVE-2026-121066","kind":"vulnerability","aliases":["CVE-2026-121066"],"related":[],"title":"Chrome: extension authorization flaw lets a crafted extension bypass access limits","description":"Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)","summary":"Google Chrome versions before 157.0.8103.38 do not correctly enforce authorization for extensions. A remote attacker who tricks a user into installing a crafted Chrome extension can bypass system access restrictions.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","linux","macos","package","windows"],"not_affected_if":["chrome-updated","extensions-restricted-by-policy"],"how_to_check":"- Check the Chrome version in Chrome's About page (chrome://settings/help) and compare it with `157.0.8103.38`.","fix":"- Google Chrome: move to `157.0.8103.38` or later.","status":"open","published_at":"2026-11-03T21:17:11+00:00","first_seen_at":"2026-11-03T21:19:11+00:00","triaged_at":"2026-11-03T21:27:02+00:00","updated_at":"2026-11-03T21:27:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T21:27:02Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: move to `157.0.8103.38` or later.","reach":"internet","title":"Chrome: extension authorization flaw lets a crafted extension bypass access limits","impact":"medium","summary":"Google Chrome versions before 157.0.8103.38 do not correctly enforce authorization for extensions. A remote attacker who tricks a user into installing a crafted Chrome extension can bypass system access restrictions.","audience":"everyone","category":"package","nicknames":[],"who_cares":["chrome","browser","windows","macos","linux"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Crafted extension bypasses system access restrictions on the user's machine.","analyst_note":"","how_to_check":"- Check the Chrome version in Chrome's About page (chrome://settings/help) and compare it with `157.0.8103.38`.\n- unknown","plain_action":"Update Google Chrome to version 157.0.8103.38 or later through Chrome's update menu.","needs_analyst":false,"not_affected_if":["chrome-updated","extensions-restricted-by-policy"],"who_is_affected":"Anyone running Google Chrome before 157.0.8103.38 is exposed, most likely when they install an extension from an untrusted source. Managed fleets should confirm every browser has the update. unknown whether non-default extension policies change exposure.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000671,"input_tokens":4112,"output_tokens":519,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121066':14A,17A '-2026':13A,16A '157.0.8103.38':28B,63C 'access':10A,52B,74C 'allow':64C 'attack':38B,67C 'author':3A,33B,55C 'browser':18B 'bypass':9A,50B,72C 'chrome':1A,19B,25B,47B,60C,79C 'chromium':81C 'correct':31B 'craft':7A,46B,78C 'cve':12A,15A 'enforc':32B 'engin':70C 'extens':2A,8A,35B,48B,57C,80C 'flaw':4A 'googl':24B,59C 'incorrect':54C 'instal':44B 'let':5A 'leverag':68C 'limit':11A 'linux':20B 'maco':21B 'medium':84C 'packag':22B 'prior':61C 'remot':37B,66C 'restrict':53B,75C 'secur':82C 'sever':83C 'social':69C 'system':51B,73C 'trick':40B 'user':42B 'version':26B 'via':76C 'window':23B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Google Chrome before 157.0.8103.38 is exposed, most likely when they install an extension from an untrusted source. Managed fleets should confirm every browser has the update. unknown whether non-default extension policies change exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.38 or later through Chrome's update menu.","pkeys":[],"ptokens":[],"labels":["browser","chrome","linux","macos","medium","package","windows"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121066","severity":null,"published_at":"2026-11-03T21:17:11+00:00","modified_at":"2026-11-03T21:17:11+00:00","first_seen_at":"2026-11-03T21:19:11+00:00","fetched_at":"2026-11-03T21:19:11+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}