CVE-2026-121104
Description
An incorrect authorization flaw was found in the FileSystem component of the Chromium browser.
Upstream bug(s):
Statement
Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce strict authorization checks in the FileSystem component to prevent sandbox escapes: upgrade to Google Chrome 157.0.8103.38 (or the fixed Chromium builds), which corrects authorization checks in the FileSystem component to prevent code execution outside the sandbox, closing all 2 injection vectors (crafted HTML page, social engineering). Until patched, this is a concern on users running affected Chromium or Google Chrome browser versions on any platform, so caution users against visiting untrusted links and interacting with untrusted or suspicious HTML pages. As a compensating measure, use Landlock LSM to restrict browser filesystem access paths at the kernel level, deploy an EDR agent to detect and block anomalous child processes or execution outside the sandbox, configure auditd to log unauthorized file access and abnormal execution events, and use Falco or eBPF runtime security to detect anomalous process spawning and sensitive file access by the browser. These controls limit blast radius and contain exploitation, but they do not fix the underlying incorrect authorization defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-506 Landlock LSM (Filesystem Sandboxing) (medium)
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data; Read Files or Directories
An attacker could bypass intended access restrictions to read sensitive data, either by reading the data directly from a data store that is not correctly restricted, or by accessing insufficiently-protected, privileged functionality to read the data.
Integrity
Technical Impact: Modify Application Data; Modify Files or Directories
An attacker could bypass intended access restrictions to modify sensitive data, either by writing the data directly to a data store that is not correctly restricted, or by accessing insufficiently-protected, privileged functionality to write the data.
Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
An attacker could bypass intended access restrictions to gain privileges by modifying or reading critical data directly, or by accessing privileged functionality.
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands
An attacker could use elevated privileges to execute unauthorized commands or code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
An attacker could gain unauthorized access to resources on the system and excessively consume those resources, leading to a denial of service.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
