{"id":"CVE-2026-121248","kind":"vulnerability","aliases":["CVE-2026-121248"],"related":[],"title":"Google Chrome: API authorization flaw lets crafted extension bypass system access restrictions","description":"Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)","summary":"An incorrect authorization check in a Chrome API lets a crafted Chrome extension bypass system access restrictions. The attacker gets access the browser is meant to block, and the source rates it Medium severity in Chromium.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","chrome","desktop","runtime"],"not_affected_if":["chrome-at-or-above-157.0.8103.38","extension-installs-blocked"],"how_to_check":"- Check the Chrome version in the browser's About page or with `google-chrome --version` on Linux; versions below `157.0.8103.38` are affected.\n- Review installed extensions for unfamiliar or unnecessary ones.","fix":"- Google Chrome: update to `157.0.8103.38` or later.","status":"open","published_at":"2026-11-03T21:17:35+00:00","first_seen_at":"2026-11-03T21:19:29+00:00","triaged_at":"2026-11-03T21:21:01+00:00","updated_at":"2026-11-03T21:21:01+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T21:21:01Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: update to `157.0.8103.38` or later.","reach":"local","title":"Google Chrome: API authorization flaw lets crafted extension bypass system access restrictions","impact":"medium","summary":"An incorrect authorization check in a Chrome API lets a crafted Chrome extension bypass system access restrictions. The attacker gets access the browser is meant to block, and the source rates it Medium severity in Chromium.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["chrome","browsers","desktop"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Malicious extension bypasses browser system access restrictions on the device.","analyst_note":"","how_to_check":"- Check the Chrome version in the browser's About page or with `google-chrome --version` on Linux; versions below `157.0.8103.38` are affected.\n- Review installed extensions for unfamiliar or unnecessary ones.","plain_action":"Update Google Chrome to version 157.0.8103.38 or later, and remove any extensions you do not recognise.","needs_analyst":false,"not_affected_if":["chrome-at-or-above-157.0.8103.38","extension-installs-blocked"],"who_is_affected":"Any device running Google Chrome before 157.0.8103.38 is exposed, since the flaw is in the browser's API handling of extensions. Exploitation requires a malicious extension to be installed, so managed browsers that block extension installs are less exposed. The sources do not say whether the bypass needs additional conditions.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000702,"input_tokens":4099,"output_tokens":585,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121248':15A,18A '-2026':14A,17A '157.0.8103.38':68C 'access':11A,38B,43B,76C 'allow':69C 'api':3A,30B,62C 'attack':41B,72C 'author':4A,25B,60C 'block':49B 'browser':19B,45B 'bypass':9A,36B,74C 'check':26B 'chrome':2A,20B,29B,34B,65C,81C 'chromium':58B,83C 'craft':7A,33B,80C 'cve':13A,16A 'desktop':21B 'extens':8A,35B,82C 'flaw':5A 'get':42B 'googl':1A,64C 'incorrect':24B,59C 'let':6A,31B 'meant':47B 'medium':55B,86C 'prior':66C 'rate':53B 'remot':71C 'restrict':12A,39B,77C 'runtim':22B 'secur':84C 'sever':56B,85C 'sourc':52B 'system':10A,37B,75C 'via':78C","nicknames":[],"mitigations":[],"who_affected":"Any device running Google Chrome before 157.0.8103.38 is exposed, since the flaw is in the browser's API handling of extensions. Exploitation requires a malicious extension to be installed, so managed browsers that block extension installs are less exposed. The sources do not say whether the bypass needs additional conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.38 or later, and remove any extensions you do not recognise.","pkeys":[],"ptokens":[],"labels":["browsers","chrome","desktop","medium","runtime"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121248","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121248","severity":null,"published_at":"2026-11-03T21:17:35+00:00","modified_at":"2026-11-03T21:17:35+00:00","first_seen_at":"2026-11-03T21:19:29+00:00","fetched_at":"2026-11-03T21:19:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}