Live › vulnerability › CVE-2026-121104
Google Chrome versions before 157.0.8103.38 have an incorrect authorization flaw in the FileSystem component. A remote attacker who tricks a user into visiting a crafted HTML page could potentially execute code outside the browser sandbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running Google Chrome before 157.0.8103.38 who opens untrusted web pages is potentially exposed, since the attack is delivered through a crafted HTML page and relies on social engineering. Managed fleets should confirm the Chrome build on every endpoint. Systems that do not run Chrome are not affected.
No product ranges from the sources yet.
157.0.8103.38.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-121104")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.