Executive brief
Google Chrome's FileSystem API is vulnerable to an authorization bypass that allows remote attackers to circumvent system access restrictions through a malicious webpage. An attacker can exploit this by crafting and hosting a specially designed HTML page that, when visited by a victim, gains unauthorized access to protected file system resources, potentially exposing sensitive files or data stored on the user's system.
Technical details
This vulnerability is a missing authorization check in Chrome's FileSystem component. The root cause is insufficient validation of access permissions when the FileSystem API processes requests from web content. The attack vector is network-based and requires user interaction (visiting a crafted HTML page); no authentication is required on the target system. A successful exploit allows an attacker to bypass file system access controls and access resources that should be restricted from web content. The vulnerability is fixed in Chrome 153.0.8010.36 and later versions.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched: Fixed in Chrome 153.0.8010.36