CVE-2026-121104

Summary

A missing authorization check in Chrome's FileSystem API allowed a remote attacker to bypass access controls and potentially execute arbitrary code outside the sandbox by tricking a user into visiting a malicious page.

Exploitability

Exploitation requires social engineering to诱导 the user to interact with a crafted HTML page, and relies on the user having an unpatched Chrome version prior to 157.0.8103.38.

Blast radius

Successful exploitation could lead to full system compromise via sandbox escape, enabling attackers to steal sensitive data, install malware, or pivot within the victim's environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Google Chrome to version 157.0.8103.38 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.