{"id":"CVE-2026-121167","kind":"vulnerability","aliases":["CVE-2026-121167"],"related":[],"title":"Chrome: permissions check lets a compromised renderer bypass system access limits","description":"Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","summary":"Google Chrome before 157.0.8103.38 has an incorrect authorization flaw in its Permissions component. A remote attacker who already compromised the renderer process can use a crafted HTML page to bypass system access restrictions.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","linux","macos","runtime","windows"],"not_affected_if":["auto-updated","chrome-157-or-later"],"how_to_check":"- Check the installed Chrome version: `chrome://settings/help` shows the running version.\n- Confirm whether it is below `157.0.8103.38`.","fix":"- Google Chrome: `157.0.8103.38`","status":"open","published_at":"2026-11-03T21:17:24+00:00","first_seen_at":"2026-11-03T21:19:23+00:00","triaged_at":"2026-11-03T21:23:20+00:00","updated_at":"2026-11-03T21:23:20+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T21:23:20Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: `157.0.8103.38`","reach":"internet","title":"Chrome: permissions check lets a compromised renderer bypass system access limits","impact":"medium","summary":"Google Chrome before 157.0.8103.38 has an incorrect authorization flaw in its Permissions component. A remote attacker who already compromised the renderer process can use a crafted HTML page to bypass system access restrictions.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["chrome","browser","windows","macos","linux"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker bypasses system access restrictions after a renderer compromise","analyst_note":"","how_to_check":"- Check the installed Chrome version: `chrome://settings/help` shows the running version.\n- Confirm whether it is below `157.0.8103.38`.","plain_action":"Update Google Chrome to version 157.0.8103.38 or later.","needs_analyst":false,"not_affected_if":["chrome-157-or-later","auto-updated"],"who_is_affected":"Any browser install of Chrome before 157.0.8103.38 is in scope, since the flaw sits in the browser's own permissions logic. The attacker must first compromise the renderer process, so this is a chained exploit rather than a standalone entry point. Managed fleets should confirm Chrome auto-update is working.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000675,"input_tokens":4110,"output_tokens":528,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121167':14A,17A '-2026':13A,16A '157.0.8103.38':27B,66C 'access':10A,55B,80C 'allow':67C 'alreadi':41B 'attack':39B,70C 'author':31B,58C 'browser':18B 'bypass':8A,53B,78C 'check':3A 'chrome':1A,19B,25B,63C 'chromium':87C 'compon':36B 'compromis':6A,42B,73C 'craft':49B,84C 'cve':12A,15A 'flaw':32B 'googl':24B,62C 'html':50B,85C 'incorrect':30B,57C 'let':4A 'limit':11A 'linux':20B 'maco':21B 'medium':90C 'page':51B,86C 'permiss':2A,35B,60C 'prior':64C 'process':45B,76C 'remot':38B,69C 'render':7A,44B,75C 'restrict':56B,81C 'runtim':22B 'secur':88C 'sever':89C 'system':9A,54B,79C 'use':47B 'via':82C 'window':23B","nicknames":[],"mitigations":[],"who_affected":"Any browser install of Chrome before 157.0.8103.38 is in scope, since the flaw sits in the browser's own permissions logic. The attacker must first compromise the renderer process, so this is a chained exploit rather than a standalone entry point. Managed fleets should confirm Chrome auto-update is working.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.38 or later.","pkeys":[],"ptokens":[],"labels":["browser","chrome","linux","macos","medium","runtime","windows"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121167","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121167","severity":null,"published_at":"2026-11-03T21:17:24+00:00","modified_at":"2026-11-03T21:17:24+00:00","first_seen_at":"2026-11-03T21:19:23+00:00","fetched_at":"2026-11-03T21:19:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}