CVE-2026-0903: Insufficient validation of untrusted input in Downloads
Chromium: CVE-2026-0903 Insufficient validation of untrusted input in Downloads
Other sources
Inappropriate implementation in Downloads in Google Chrome on Windows prior to 144.0.7559.59 allowed a remote attacker to bypass dangerous file type protections via a malicious file. (Chromium security severity: Medium)
— MITRE
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Credit
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-0903?
CVE-2026-0903 is classified as a high severity vulnerability due to insufficient validation of untrusted input.
How do I fix CVE-2026-0903?
To fix CVE-2026-0903, users should update to Google Chrome version 144.0.7559.59 or later, or the appropriate version of Microsoft Edge.
Which versions of Chrome are affected by CVE-2026-0903?
Google Chrome versions prior to 144.0.7559.59 are affected by CVE-2026-0903.
Are Microsoft Edge versions vulnerable to CVE-2026-0903?
Yes, Microsoft Edge (Chromium-based) versions prior to 144.0.3719.82 are also vulnerable to CVE-2026-0903.
What kind of attack does CVE-2026-0903 enable?
CVE-2026-0903 could potentially allow for arbitrary code execution due to the insufficient validation of input.