{"id":"CVE-2026-126872","kind":"vulnerability","aliases":["CVE-2026-126872"],"related":[],"title":"Chrome: FileSystem authorization flaw lets crafted web page run code","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"Google Chrome before 157.0.8103.78 has an incorrect authorization check in its FileSystem component. A remote attacker who tricks a user into opening a crafted HTML page can execute arbitrary code outside the browser sandbox.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","chrome","endpoints","other"],"not_affected_if":["chrome-157-or-later"],"how_to_check":"- Check the Chrome version in Chrome's About page (Settings > About Chrome) and compare it with `157.0.8103.78`.\n- Chrome is affected if the version is below `157.0.8103.78`.","fix":"- Google Chrome: move to `157.0.8103.78` or later.","status":"open","published_at":"2026-11-11T23:17:15+00:00","first_seen_at":"2026-11-11T23:29:37+00:00","triaged_at":"2026-11-11T23:32:21+00:00","updated_at":"2026-11-11T23:32:21+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T23:32:21Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: move to `157.0.8103.78` or later.","reach":"internet","title":"Chrome: FileSystem authorization flaw lets crafted web page run code","impact":"high","summary":"Google Chrome before 157.0.8103.78 has an incorrect authorization check in its FileSystem component. A remote attacker who tricks a user into opening a crafted HTML page can execute arbitrary code outside the browser sandbox.","audience":"everyone","category":"other","nicknames":[],"who_cares":["chrome","browsers","endpoints"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs arbitrary code outside the browser sandbox on the user's machine.","analyst_note":"","how_to_check":"- Check the Chrome version in Chrome's About page (Settings > About Chrome) and compare it with `157.0.8103.78`.\n- Chrome is affected if the version is below `157.0.8103.78`.","plain_action":"Update Google Chrome to version 157.0.8103.78 or later by restarting the browser after the update installs.","product_name":"","needs_analyst":false,"not_affected_if":["chrome-157-or-later"],"who_is_affected":"Anyone running Google Chrome before 157.0.8103.78 is exposed, and the attack needs a user to visit a crafted HTML page. Chromium-based browsers that pull the same engine version may also be affected, and those should be checked against their own release notes. Managed fleets should confirm the Chrome version on every endpoint.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000738,"input_tokens":4544,"output_tokens":567,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126872':13A,16A '-2026':12A,15A '157.0.8103.78':23B,63C 'allow':64C 'arbitrari':48B,73C 'attack':35B,67C 'author':3A,27B,55C 'browser':17B,52B 'check':28B 'chrome':1A,18B,21B,60C 'chromium':83C 'code':10A,49B,74C 'compon':32B 'craft':6A,43B,80C 'cve':11A,14A 'endpoint':19B 'engin':70C 'execut':47B,72C 'filesystem':2A,31B,57C 'flaw':4A 'googl':20B,59C 'high':86C 'html':44B,81C 'incorrect':26B,54C 'let':5A 'leverag':68C 'open':41B 'outsid':50B,75C 'page':8A,45B,82C 'prior':61C 'remot':34B,66C 'run':9A 'sandbox':53B,77C 'secur':84C 'sever':85C 'social':69C 'trick':37B 'user':39B 'via':78C 'web':7A","nicknames":[],"mitigations":[],"who_affected":"Anyone running Google Chrome before 157.0.8103.78 is exposed, and the attack needs a user to visit a crafted HTML page. Chromium-based browsers that pull the same engine version may also be affected, and those should be checked against their own release notes. Managed fleets should confirm the Chrome version on every endpoint.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.78 or later by restarting the browser after the update installs.","pkeys":[],"ptokens":[],"labels":["browsers","chrome","endpoints","high","other"],"campaign_type":null,"search_a":"'-126872':13A,16A '-2026':12A,15A 'author':3A 'chrome':1A 'code':10A 'craft':6A 'cve':11A,14A 'filesystem':2A 'flaw':4A 'let':5A 'page':8A 'run':9A 'web':7A","search_b":"'157.0.8103.78':23B 'arbitrari':48B 'attack':35B 'author':27B 'browser':17B,52B 'check':28B 'chrome':18B,21B 'code':49B 'compon':32B 'craft':43B 'endpoint':19B 'execut':47B 'filesystem':31B 'googl':20B 'html':44B 'incorrect':26B 'open':41B 'outsid':50B 'page':45B 'remot':34B 'sandbox':53B 'trick':37B 'user':39B","search_c":"'157.0.8103.78':63C 'allow':64C 'arbitrari':73C 'attack':67C 'author':55C 'chrome':60C 'chromium':83C 'code':74C 'craft':80C 'engin':70C 'execut':72C 'filesystem':57C 'googl':59C 'high':86C 'html':81C 'incorrect':54C 'leverag':68C 'outsid':75C 'page':82C 'prior':61C 'remot':66C 'sandbox':77C 'secur':84C 'sever':85C 'social':69C 'via':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T23:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126872","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126872","severity":null,"published_at":"2026-11-11T23:17:15+00:00","modified_at":"2026-11-11T23:17:16+00:00","first_seen_at":"2026-11-11T23:29:37+00:00","fetched_at":"2026-11-11T23:29:37+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}