Description

Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-02T00:18:29.310Z",
  "pubdate": "2026-09-02T00:18:29.310Z",
  "executiveSummary": "This vulnerability involves an incorrect authorization flaw within the FileSystem component of Google Chrome, which potentially allows a remote attacker to achieve arbitrary code execution outside the browser's security sandbox.\nThe vulnerability is categorized as a high-severity security issue affecting versions of Google Chrome prior to 152.0.7977.75.\nExploitation requires the attacker to employ social engineering techniques to trick a user into interacting with a specifically crafted HTML page.\nSuccessful exploitation bypasses the sandboxing mechanisms intended to restrict browser processes, granting the attacker the ability to execute unauthorized code on the host system.\nThe impact is significant, as it permits full system compromise or persistence beyond the web browser's isolated environment, posing a critical risk to user confidentiality, integrity, and availability.",
  "technicalDetails": "The vulnerability resides in the FileSystem API implementation within the Chromium rendering engine. An incorrect authorization check fails to properly validate the origin or permissions context during file system interactions initiated by web content.\nThe root cause is a failure to adequately constrain FileSystem operations, allowing a malicious script—when triggered via a crafted HTML page—to manipulate or interact with file system resources in a manner that transcends the intended security boundary of the renderer process.\nThe attack flow begins when an attacker lures a user to a malicious web page through social engineering tactics. Upon navigation, the page executes JavaScript designed to trigger the vulnerable FileSystem authorization logic.\nBy bypassing the intended authorization checks, the attacker exploits a lack of process-level isolation for file system operations. This allows the execution of arbitrary payloads that run with the privileges of the browser process, eventually facilitating an escape from the renderer sandbox.\nOnce the sandbox is breached, the attacker gains the ability to execute arbitrary native code on the host operating system. This transition from a restricted browser environment to the host execution context bypasses the layered security protections designed to contain web-based threats.\nThe vulnerability affects all Google Chrome installations prior to version 152.0.7977.75. Because the flaw is rooted in the browser's internal logic, it does not require prior authentication or elevated privileges from the user, relying instead on the successful execution of the crafted HTML payload within the victim's browser environment.\nPost-exploitation activities can range from data exfiltration and the installation of persistent malware to full remote control of the compromised machine, as the code executes outside the restricted confines of the sandbox environment."
}