External risk intelligence

Google Chrome FileSystem Authorization Flaw Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-121071

This vulnerability affects a client-side web browser. Exploitation requires a user to be socially engineered into visiting a specifically crafted HTML page. As a client-side application typically running on a local workstation rather than acting as a public-facing network service, it does not represent an internet-reachable attack surface in common deployments.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves an authorization flaw in the Google Chrome browser that could allow a malicious website to execute code outside its security sandbox. While exploitation requires a user to interact with a crafted webpage, it highlights a potential risk in how the browser handles user permissions. The primary concern is to confirm if this specific type of exposure is relevant to our environment.

Flaw lets malicious sites run code outside browser limits.
It requires users to visit a crafted webpage.
Confirm relevance and potential exposure in our environment.

Attack Path

How an attacker could exploit the issue

An attacker could leverage social engineering to trick a user into visiting a malicious HTML page. This page would then interact with the FileSystem component in Google Chrome, exploiting an incorrect authorization flaw. Successful exploitation could lead to arbitrary code execution outside the browser's sandbox.

Social engineering for user interaction.
Crafted HTML page triggers vulnerability.
Arbitrary code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

The vulnerability in Google Chrome's FileSystem component could allow a remote attacker to execute arbitrary code outside the browser sandbox. This occurs when a user is tricked into visiting a specially crafted HTML page, leading to an authorization bypass that allows the attacker to perform actions beyond the browser's security restrictions.

Arbitrary code execution outside sandbox.
User visits crafted HTML page.
Host system compromise possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects a client-side application, requiring user interaction through social engineering to exploit. The first practical step is to identify all instances of the affected technology, confirm their business criticality and network reachability, and then engage the accountable owner to plan remediation.

Browser owners should manage this issue.
Verify user exposure and social engineering risk.
Plan controlled updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome and the FileSystem component?

Google Chrome is a web browser used to navigate the internet. The FileSystem component is an internal feature that allows web applications to store and manage files on a local device in a controlled way, bridging the gap between browser-based tasks and local storage.

What does incorrect authorization mean for CVE-2026-121071?

This refers to CWE-863, where the software fails to properly verify if a user or action has permission to perform a task. In this case, the browser mistakenly grants too much privilege to a website, allowing it to bypass security boundaries and run unauthorized code.

How does an attacker trigger this vulnerability?

An attacker must use social engineering to trick a user into opening a specifically crafted HTML page. Simply having the browser installed or running in the background does not trigger the bug; the code execution only occurs if a user actively interacts with the malicious webpage.

Is this vulnerability an internet-facing threat?

According to Halo Surface Signal, this is considered unlikely to be an internet-reachable attack surface. Because it is a client-side browser application on a local workstation rather than a public server, it does not typically expose the host to network-based attacks without direct user interaction.

What steps should I take if I use Google Chrome?

Your first step is to ensure your browser is updated to version 157.0.8103.38 or later. Since this vulnerability relies on social engineering, you should also stay alert for suspicious links or unexpected prompts while browsing and ensure your organizational security policy for browser updates is active.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.