Executive brief
Google Chrome's FileAPI component failed to properly validate user input, allowing an attacker with control over the browser's renderer process to bypass the security sandbox and execute arbitrary code on the host system. This could lead to complete system compromise, data theft, or malware installation on affected computers.
Technical details
This vulnerability is an improper input validation flaw in Chrome's FileAPI component. It requires the attacker to first compromise the renderer process, which typically happens via a separate vulnerability (such as a memory corruption bug). Once the renderer process is compromised, the attacker can craft a malicious HTML page that exploits the input validation weakness to escape the sandbox and execute arbitrary code outside of Chrome's security boundary. The vulnerability was fixed in Chrome 153.0.8010.36 and later releases.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched: Fixed in Chrome 153.0.8010.36