Executive brief
Google Chrome's FileAPI component contains an authorization bypass vulnerability that allows attackers to circumvent system access restrictions. An attacker can exploit this through a crafted HTML page served via social engineering, potentially gaining unauthorized access to protected files or sensitive resources on a user's system.
Technical details
This vulnerability is an incorrect authorization flaw in Chrome's FileAPI implementation. The vulnerability allows a remote attacker to bypass system access restrictions through a crafted HTML page, requiring social engineering to trick a user into visiting a malicious site. The attack is network-based and does not require elevated privileges or prior authentication. An attacker can leverage this to access files or resources that should be protected by browser security policies. The fix is available in Chrome version 153.0.8010.36 and later.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched