Description
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)
Published: 2026-11-03
Score: n/a
EPSS: n/a
KEV: No
Impact: Privilege Escalation via DevTools
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a missing authorization check in Google Chrome’s DevTools, enabling an attacker who delivers crafted network traffic to a user to bypass system access restrictions and gain unauthorized access to system resources. The Chromium security team rated the severity as Medium.

Affected Systems

Google Chrome version 157.0.8103.38 and earlier are affected.

Risk and Exploitability

The EPSS score is not available and the flaw is not listed in CISA’s KEV catalog. Exploitation requires a user to interact with crafted network traffic that is processed by DevTools, likely through social engineering. The risk is limited to systems running the affected browser version and not actively updated.

Generated by OpenCVE AI on November 3, 2026 at 22:16 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 157.0.8103.38 or newer, which removes the missing authorization check in DevTools.
  • If an update is not immediately possible, restrict or disable DevTools access through Chrome policies or user settings to prevent accidental usage.
  • Deploy network traffic monitoring to detect abnormal or crafted packets that might target DevTools, and alert administrators to potential attempts.

Generated by OpenCVE AI on November 3, 2026 at 22:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 03 Nov 2026 22:45:00 +0000

Type Values Removed Values Added
Title Missing Authorization in Chrome DevTools Allows Remote Access via Crafted Network Traffic

Tue, 03 Nov 2026 20:45:00 +0000

Type Values Removed Values Added
Description Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)
Weaknesses CWE-862
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T20:42:44.736Z

Reserved: 2026-11-03T09:49:28.525Z

Link: CVE-2026-121136

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-03T21:17:22.217

Modified: 2026-11-03T21:17:22.310

Link: CVE-2026-121136

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T23:00:07Z

Weaknesses