Executive brief
Google Chrome's FileSystem component contained a missing authorization check that could allow an attacker to execute arbitrary code outside the browser's sandbox. An attacker who had already compromised the browser's renderer process could exploit this flaw via a malicious HTML page to escape the sandbox and run code with elevated privileges, potentially compromising the entire system.
Technical details
This vulnerability is a missing authorization flaw in Chrome's FileSystem component. The attack requires an attacker to have first compromised the renderer process (the sandboxed component that executes web content), then use social engineering to trick a user into opening a crafted HTML page. Once triggered, the missing authorization check allows the attacker to bypass sandbox restrictions and execute arbitrary code in the context of the browser process. The vulnerability was patched in Chrome version 153.0.8010.36 and later. While the Chromium security team classified this as "Medium" severity, the CVSS score of 8.3 reflects the high impact of sandbox escape.
Affected products
- Google Chrome before 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched