CVE-2026-121101

chromium-browser: Missing authorization in DevTools

View on CVE.org
Published Nov 3, 2026 CVSS 3.1 · 4.3 Medium EPSS n/a KEV · Not listed
Description
Published Prematurely

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}

 cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}
Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Description Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted Chrome extension. (Chromium security severity: Low) Published Prematurely
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}
Type Values Removed Values Added
Title Privilege Escalation via Insecure DevTools Extension Access in Google Chrome chromium-browser: Missing authorization in DevTools
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}

threat_severity

Low
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Privilege Escalation via Insecure DevTools Extension Access in Google Chrome
Type Values Removed Values Added
Description Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted Chrome extension. (Chromium security severity: Low)
Weaknesses CWE-862
References
Earlier changes (5)
Weaknesses

Sources

Status
REJECTED
Assigner
Chrome
Published
Updated
Nov 10, 2026, 11:24 PM
Reserved
Nov 3, 2026, 9:29 AM

View source JSON

Updated

JSON

Status
Rejected
Published
Nov 3, 2026, 9:17 PM
Modified
Nov 11, 2026, 12:18 AM

View source JSON

Severity
Low
Public date
Nov 3, 2026, 8:42 PM

View source Bugzilla JSON

No data.