Description

Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-10-02T16:16:43.717Z",
  "pubdate": "2026-10-02T16:16:43.717Z",
  "executiveSummary": "This vulnerability involves an incorrect authorization flaw within the FileSystem component of Google Chrome on the Windows platform.\nThe flaw allows a remote attacker to bypass sandbox restrictions, facilitating arbitrary code execution on the underlying host system.\nSuccessful exploitation requires the attacker to employ social engineering tactics to lure a user into interacting with a specifically crafted HTML page.\nThe vulnerability carries a High severity rating, as it compromises the core security boundary between the web content process and the operating system.\nImpact includes potential full system compromise, unauthorized data access, and persistent malware installation.\nAffected systems are limited to Google Chrome versions on Windows prior to 154.0.8037.97.\nRisk mitigation is contingent upon upgrading to the specified patched version or later to eliminate the underlying authorization weakness.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper authorization implementation within the Chrome FileSystem API component. This component is responsible for managing isolated file access for web applications, strictly enforcing security boundaries that prevent web content from accessing arbitrary locations on the host filesystem.\nThe flaw manifests when the FileSystem component fails to adequately validate or constrain access requests initiated from a compromised renderer process. An attacker can leverage this oversight by hosting a malicious, crafted HTML page that exploits the improper authorization logic during a user-triggered file system interaction.\nThe attack flow begins when an attacker uses social engineering to induce a victim to navigate to the malicious URL. Once loaded, the crafted page triggers a specific sequence of API calls that manipulate the FileSystem interface, effectively tricking the browser into performing unauthorized file operations outside of the designated sandbox environment.\nBy bypassing these sandbox restrictions, the attacker can interact with sensitive files or execute arbitrary payloads residing on the host OS. This transition from a sandbox-restricted web context to the host context effectively negates the security architecture intended to isolate browser processes from the Windows kernel and user space.\nThe exploitation path relies heavily on the ability to escape the browser sandbox, a critical security layer in Chromium architecture. The authorization failure permits the attacker to elevate their privileges from the limited renderer process to that of the user running the browser process, granting the ability to execute code with the permissions of the current logged-in user.\nThe vulnerability specifically affects versions of Google Chrome on Windows prior to 154.0.8037.97. There are no authentication requirements for the attacker, but the exploit is contingent upon successful social engineering to facilitate initial user interaction. The exploitation process is network-accessible, as the malicious HTML content is served remotely via standard HTTP/HTTPS protocols, making it a viable vector for drive-by download or phishing campaigns."
}