{"id":"CVE-2026-126860","kind":"vulnerability","aliases":["CVE-2026-126860"],"related":[],"title":"Chrome: flaw in FileSystem lets crafted page escape sandbox","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"Google Chrome versions before 157.0.8103.78 have an incorrect authorization flaw in the FileSystem component. A remote attacker who tricks a user into opening a crafted HTML page could potentially run arbitrary code outside the browser sandbox.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chrome","desktop-browser","linux","macos","other","windows"],"not_affected_if":["chrome-up-to-date"],"how_to_check":"- Open Chrome's About page (chrome://version) and compare the version with `157.0.8103.78`","fix":"- Google Chrome: `157.0.8103.78`","status":"open","published_at":"2026-11-11T23:17:14+00:00","first_seen_at":"2026-11-11T23:29:37+00:00","triaged_at":"2026-11-11T23:33:29+00:00","updated_at":"2026-11-11T23:33:29+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T23:33:29Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: `157.0.8103.78`","reach":"internet","title":"Chrome: flaw in FileSystem lets crafted page escape sandbox","impact":"high","summary":"Google Chrome versions before 157.0.8103.78 have an incorrect authorization flaw in the FileSystem component. A remote attacker who tricks a user into opening a crafted HTML page could potentially run arbitrary code outside the browser sandbox.","audience":"everyone","category":"other","nicknames":[],"who_cares":["chrome","desktop-browser","windows","macos","linux"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Code runs outside the browser sandbox on the user's machine.","analyst_note":"","how_to_check":"- Open Chrome's About page (chrome://version) and compare the version with `157.0.8103.78`\n- unknown","plain_action":"Update Google Chrome to version 157.0.8103.78 or later.","product_name":"","needs_analyst":false,"not_affected_if":["chrome-up-to-date"],"who_is_affected":"Desktop Google Chrome installs older than 157.0.8103.78 are affected, and exposure comes from visiting a malicious page. The sources do not say whether other Chromium-based browsers are affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4547,"output_tokens":484,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126860':12A,15A '-2026':11A,14A '157.0.8103.78':28B,69C 'allow':70C 'arbitrari':54B,80C 'attack':40B,73C 'author':32B,61C 'browser':19B,58B 'chrome':1A,16B,25B,66C 'chromium':90C 'code':55B,81C 'compon':37B 'could':51B 'craft':6A,48B,87C 'cve':10A,13A 'desktop':18B 'desktop-brows':17B 'engin':76C 'escap':8A 'execut':79C 'filesystem':4A,36B,63C 'flaw':2A,33B 'googl':24B,65C 'high':93C 'html':49B,88C 'incorrect':31B,60C 'let':5A 'leverag':74C 'linux':20B 'maco':21B 'open':46B 'outsid':56B,82C 'page':7A,50B,89C 'potenti':52B,78C 'prior':67C 'remot':39B,72C 'run':53B 'sandbox':9A,59B,84C 'secur':91C 'sever':92C 'social':75C 'trick':42B 'user':44B 'version':26B 'via':85C 'window':23B","nicknames":[],"mitigations":[],"who_affected":"Desktop Google Chrome installs older than 157.0.8103.78 are affected, and exposure comes from visiting a malicious page. The sources do not say whether other Chromium-based browsers are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.78 or later.","pkeys":[],"ptokens":[],"labels":["chrome","desktopbrowser","high","linux","macos","other","windows"],"campaign_type":null,"search_a":"'-126860':12A,15A '-2026':11A,14A 'chrome':1A 'craft':6A 'cve':10A,13A 'escap':8A 'filesystem':4A 'flaw':2A 'let':5A 'page':7A 'sandbox':9A","search_b":"'157.0.8103.78':28B 'arbitrari':54B 'attack':40B 'author':32B 'browser':19B,58B 'chrome':16B,25B 'code':55B 'compon':37B 'could':51B 'craft':48B 'desktop':18B 'desktop-brows':17B 'filesystem':36B 'flaw':33B 'googl':24B 'html':49B 'incorrect':31B 'linux':20B 'maco':21B 'open':46B 'outsid':56B 'page':50B 'potenti':52B 'remot':39B 'run':53B 'sandbox':59B 'trick':42B 'user':44B 'version':26B 'window':23B","search_c":"'157.0.8103.78':69C 'allow':70C 'arbitrari':80C 'attack':73C 'author':61C 'chrome':66C 'chromium':90C 'code':81C 'craft':87C 'engin':76C 'execut':79C 'filesystem':63C 'googl':65C 'high':93C 'html':88C 'incorrect':60C 'leverag':74C 'outsid':82C 'page':89C 'potenti':78C 'prior':67C 'remot':72C 'sandbox':84C 'secur':91C 'sever':92C 'social':75C 'via':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T23:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126860","severity":null,"published_at":"2026-11-11T23:17:14+00:00","modified_at":"2026-11-11T23:17:14+00:00","first_seen_at":"2026-11-11T23:29:37+00:00","fetched_at":"2026-11-11T23:29:37+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}