Google Chrome: incorrect authorization in FileSystem (CVE-2026-121060)
A vulnerability, CVE-2026-121060 (CVSS 9.6), was found in the FileSystem component of Google Chrome. A remote attacker using social engineering and a crafted HTML page could potentially execute code outside the sandbox. Chromium rates its severity as High.
Checked in Shield: no
Who is affected
Google Chrome versions prior to 157.0.8103.38 are affected. Chromium-based builds of the same branch are likely affected too, but the source does not confirm this directly.
How to check
Check the Chrome or chromium version on your device or server. If it is below 157.0.8103.38, the browser is vulnerable. Also find out why chromium is installed on the server and whether it opens untrusted URLs.
How to fix
A fix exists: Chrome 157.0.8103.38 and newer. For the chromium package in Debian, watch for the update and install it as soon as it is released. If the browser is not needed, remove it.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether the flaw is exploited in the wild is not disclosed yet. Source: NVD, CVE-2026-121060.
