CVE-2026-126872

Google Chrome remote code execution via sandbox escape in FileSystem

critical · 9.6

Fix listed

Google Chrome

Published Nov 11, 2026, 22:38 UTC

Description

Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Reported fixed versions

157.0.8103.78

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.