CVE-2026-126866: Incorrect authorization in Extensions
Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: High)
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 157.0.8103.78
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-126885
- CVE-2026-126895
- CVE-2026-126879
- CVE-2026-126846
- CVE-2026-126911
- CVE-2026-126864
- CVE-2026-126889
- CVE-2026-126859
- CVE-2026-126886
- CVE-2026-126887
- CVE-2026-126870
- CVE-2026-126912
- CVE-2026-126919
- CVE-2026-126878
- CVE-2026-126909
- CVE-2026-126847
- CVE-2026-126853
- CVE-2026-126865
- CVE-2026-126916
- CVE-2026-126903
- CVE-2026-126910
- CVE-2026-126842
- CVE-2026-126898
- CVE-2026-126871
- CVE-2026-126875
- CVE-2026-126862
- CVE-2026-126900
- CVE-2026-126904
- CVE-2026-126907
- CVE-2026-126851
- CVE-2026-126845
- CVE-2026-126881
- CVE-2026-126867
- CVE-2026-126863
- CVE-2026-126896
- CVE-2026-126869
- CVE-2026-126858
- CVE-2026-126891
- CVE-2026-126874
- CVE-2026-126876
- CVE-2026-126918
- CVE-2026-126844
- CVE-2026-126884
- CVE-2026-126894
- CVE-2026-126861
- CVE-2026-126917
- CVE-2026-126856
- CVE-2026-126905
- CVE-2026-126873
- CVE-2026-126922
- CVE-2026-126914
- CVE-2026-126880
- CVE-2026-126872
- CVE-2026-126877
- CVE-2026-126888
- CVE-2026-126843
- CVE-2026-126854
- CVE-2026-126892
- CVE-2026-126897
- CVE-2026-126857
- CVE-2026-126883
- CVE-2026-126840
- CVE-2026-126848
- CVE-2026-126882
- CVE-2026-126906
- CVE-2026-126915
- CVE-2026-126893
- CVE-2026-126855
- CVE-2026-126908
- CVE-2026-126849
- CVE-2026-126901
- CVE-2026-126852
- CVE-2026-126850
- CVE-2026-126841
- CVE-2026-126902
- CVE-2026-126868
- CVE-2026-126921
- CVE-2026-126913
- CVE-2026-126890
- CVE-2026-126860
- CVE-2026-126920
- CVE-2026-126899
Frequently Asked Questions
Who is exposed to this issue?
Users of Google Chrome versions earlier than 157.0.8103.78 are affected if they can be persuaded through social engineering to use a crafted Chrome extension.
What does an attacker need to exploit it?
The attacker needs to leverage social engineering and a crafted Chrome extension. Successful exploitation can result in arbitrary code execution inside the Chrome sandbox.
What is the remediation?
Update Google Chrome to version 157.0.8103.78 or later.