---
id: "CVE-2026-121183"
kind: "vulnerability"
aliases: ["CVE-2026-121183"]
title: "Chrome: extension authorization flaw lets a compromised renderer escape the sandbox"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browser", "chrome", "desktop", "runtime"]
not_affected_if: ["chrome-at-or-above-157.0.8103.38"]
published_at: "2026-11-03T21:17:26+00:00"
first_seen_at: "2026-11-03T21:19:24+00:00"
updated_at: "2026-11-03T21:23:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121183", "first_seen_at": "2026-11-03T21:19:24+00:00"}]
---

# Chrome: extension authorization flaw lets a compromised renderer escape the sandbox

An incorrect authorization check in Chrome's Extensions component lets an attacker who already controls the renderer process run code outside the browser sandbox. The attacker needs a crafted HTML page to trigger it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Chrome version at chrome://settings/help and compare it with the fixed version below.

## Fix

- Google Chrome: move to `157.0.8103.38` or later.

## Timeline

- 2026-11-03T21:19:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121183

## From the sources

Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_