CVE-2026-121108
Description
A confused deputy flaw was found in the BackgroundFetch component of the Chromium browser.
Upstream bug(s):
Statement
Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Understanding the Weakness (CWE)
Non-Repudiation,Access Control
Technical Impact: Gain Privileges or Assume Identity; Hide Activities; Execute Unauthorized Code or Commands; Bypass Protection Mechanism
If an attacker cannot directly contact a target, but the product has access to the target, then the attacker can send a request to the product and have it be forwarded to the target. The source of this request would appear to be coming from the product's system, not the attacker's system, leading the product/system to act as a proxy or other intermediary between the upstream component and the external actor. As a result, the attacker can bypass access controls (such as firewalls) or hide the source of malicious requests, since the requests would not be coming directly from the attacker.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
