CVE-2026-0903

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0903", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "state": "PUBLISHED", "assignerShortName": "Chrome", "dateReserved": "2026-01-13T18:20:17.013Z", "datePublished": "2026-01-20T04:14:15.784Z", "dateUpdated": "2026-01-20T15:28:59.338Z"}, "containers": {"cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"version": "144.0.7559.59", "status": "affected", "lessThan": "144.0.7559.59", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in Downloads in Google Chrome on Windows prior to 144.0.7559.59 allowed a remote attacker to bypass dangerous file type protections via a malicious file. (Chromium security severity: Medium)"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Insufficient validation of untrusted input", "cweId": "CWE-20"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2026-01-20T04:14:15.784Z"}, "references": [{"url": "https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_13.html"}, {"url": "https://issues.chromium.org/issues/444803530"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T15:28:55.536206Z", "id": "CVE-2026-0903", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T15:28:59.338Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-0903", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T15:28:55.536206Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T14:57:55.108Z"}}], "cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"status": "affected", "version": "144.0.7559.59", "lessThan": "144.0.7559.59", "versionType": "custom"}]}], "references": [{"url": "https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_13.html"}, {"url": "https://issues.chromium.org/issues/444803530"}], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in Downloads in Google Chrome on Windows prior to 144.0.7559.59 allowed a remote attacker to bypass dangerous file type protections via a malicious file. (Chromium security severity: Medium)"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "Insufficient validation of untrusted input"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2026-01-20T04:14:15.784Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0903", "state": "PUBLISHED", "dateUpdated": "2026-01-20T15:28:59.338Z", "dateReserved": "2026-01-13T18:20:17.013Z", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "datePublished": "2026-01-20T04:14:15.784Z", "assignerShortName": "Chrome"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Chrome", "vendor": "Google", "versions": [{"lessThan": "144.0.7559.59", "status": "affected", "version": "144.0.7559.59", "versionType": "custom"}]}], "source": "chrome-cve-admin@google.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "7322229C-61DF-4A91-9816-F7796F9AABCD", "versionEndExcluding": "144.0.7559.59", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "258B923C-054B-4411-9E82-36C89A6BE4C4", "versionEndExcluding": "144.0.7559.60", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in Downloads in Google Chrome on Windows prior to 144.0.7559.59 allowed a remote attacker to bypass dangerous file type protections via a malicious file. (Chromium security severity: Medium)"}, {"lang": "es", "value": "Implementaci\u00f3n inapropiada en Descargas en Google Chrome en Windows anterior a 144.0.7559.59 permiti\u00f3 a un atacante remoto eludir las protecciones de tipos de archivo peligrosos mediante un archivo malicioso. (Gravedad de seguridad de Chromium: Media)"}], "id": "CVE-2026-0903", "lastModified": "2026-06-17T10:11:36.037", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0903", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T15:28:55.536206Z", "version": "2.0.3"}}]}, "published": "2026-01-20T05:16:15.733", "references": [{"source": "chrome-cve-admin@google.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_13.html"}, {"source": "chrome-cve-admin@google.com", "tags": ["Issue Tracking", "Permissions Required"], "url": "https://issues.chromium.org/issues/444803530"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "chrome-cve-admin@google.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T04:50:12.701410+00:00", "value": {"mitigation_remediation": ["Upgrade to Chrome version 144.0.7559.59 or newer.", "Enable or maintain Chrome's Safe Browsing and File Type Protection settings to reinforce the defense, especially if an update is delayed.", "Educate users to avoid opening downloaded files from untrusted or unknown sources, and verify file signatures when possible."], "summary": {"action": "Update Browser", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Google Chrome for Windows on all versions prior to 144.0.7559.59 is affected. The vulnerability exists only on the Windows platform, regardless of the operating system indicated by CPE entries for macOS, Linux, or Windows; however, Chrome on those other platforms is not impacted by this specific flaw. Users should ensure their Chrome installation is updated to 144.0.7559.59 or later to eliminate the issue.", "description_and_impact": "Inappropriate handling of file downloads in Google Chrome for Windows causes the browser to ignore dangerous file type protections when a malicious file is presented. The flaw, classified as CWE\u201120, allows a remote attacker to supply a file that bypasses the browser\u2019s safeguards, enabling the user to open or execute the file. This can lead to remote code execution if the user interacts with the downloaded content, reflecting the medium severity assigned by Chromium.", "risk_and_exploitability": "The CVSS base score of 5.4 indicates a moderate risk, while the EPSS score of less than 1\u202f% suggests that exploitation is unlikely to be widespread. The vulnerability does not appear in the CISA KEV catalog, and no commercial exploits are publicly reported. Attackers would need to host a malicious file or compromise a site to deliver it, and a user must download and open the file for the bypass to succeed. Overall, the threat remains moderate in both impact and likelihood."}}}}, "created": "2026-01-20T08:40:06.662985+00:00", "title": "Bypass Dangerous File Type Protections in Chrome Downloads on Windows", "updated": "2026-04-18T05:00:06.028019+00:00", "vendors": ["google", "google$PRODUCT$chrome", "microsoft", "microsoft$PRODUCT$windows"]}