Description
Insufficient policy enforcement in FileSystem in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-06-30
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Insufficient policy enforcement in Chrome's FileSystem API allows a remote attacker to bypass the browser's discretionary access control by loading a specially crafted HTML page. The flaw permits the attacker to read or write files that are not explicitly granted by the user, potentially leading to data leakage or modification. The weakness is an improper access control issue (CWE-284).

Affected Systems

Google Chrome installations running a version earlier than 150.0.7871.47 are affected. That includes all desktop builds before the June 2026 stable channel update. The vulnerability is present in every Chrome build prior to the patched release.

Risk and Exploitability

The CVSS score is 4.3, and the EPSS score is < 1%, indicating a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. The Chromium severity is low. Based on the description, the likely attack vector is a crafted page that a user must open. If successful, the attacker can read or modify files that normally fall under Chrome's sandbox protections.

Generated by OpenCVE AI on August 2, 2026 at 00:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 150.0.7871.47 or newer to fix the improper access control flaw in the FileSystem API.
  • Disable or restrict the FileSystem API for untrusted or user-generated content by using browser flags or site‑specific restrictions to avoid relying on the browser's discretionary access control.
  • Avoid visiting or allowing untrusted websites that might embed malicious HTML; implement network‑level defenses such as blocking known malicious hosts or using a web filter to reduce exposure.

Generated by OpenCVE AI on August 2, 2026 at 00:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Wed, 29 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Title Insufficient FileSystem Policy Enforcement Allows Discretionary Access Control Bypass in Chrome

Sat, 25 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
Title Chrome FileSystem API Access Control Bypass via Malicious Web Page

Tue, 21 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title Chrome FileSystem API Access Control Bypass via Malicious Web Page

Thu, 16 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Title Chrome FileSystem API Access Control Bypass via Crafted HTML

Tue, 14 Jul 2026 11:45:00 +0000

Type Values Removed Values Added
Title Chrome FileSystem API Access Control Bypass via Crafted HTML

Sun, 12 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Title Chrome FileSystem API Access Control Bypass via Crafted HTML

Sat, 11 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
Title Chrome FileSystem API Access Control Bypass via Crafted HTML

Fri, 10 Jul 2026 18:00:00 +0000

Type Values Removed Values Added
Title Chrome FileSystem API Access Control Bypass

Thu, 09 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Title Chrome FileSystem API Access Control Bypass

Wed, 08 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Title Chrome FileSystem API Access Control Bypass

Tue, 07 Jul 2026 16:00:00 +0000

Type Values Removed Values Added
Title Chrome FileSystem API Access Control Bypass

Mon, 06 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title FileSystem API Access Control Bypass in Google Chrome

Mon, 06 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Title FileSystem API Access Control Bypass in Google Chrome

Sun, 05 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title Chrome FileSystem API Access Control Bypass via Malicious HTML

Sat, 04 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Title Chrome FileSystem API Access Control Bypass via Malicious HTML

Sat, 04 Jul 2026 07:45:00 +0000

Type Values Removed Values Added
Title Chrome FileSystem API Access Control Bypass via Crafted HTML

Fri, 03 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
Title Chrome FileSystem API Access Control Bypass via Crafted HTML

Fri, 03 Jul 2026 05:15:00 +0000

Type Values Removed Values Added
Title Chrome FileSystem API Improper Access Control Allows Remote File Access

Thu, 02 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Title Chrome FileSystem API Improper Access Control Allows Remote File Access

Thu, 02 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Title Chrome Browser Bypass of FileSystem Access Control via Crafted HTML Page

Thu, 02 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
Title Chrome Browser Bypass of FileSystem Access Control via Crafted HTML Page

Wed, 01 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title FileSystem API Access Control Bypass via Crafted HTML

Wed, 01 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
Title FileSystem API Access Control Bypass via Crafted HTML
Weaknesses CWE-284

Wed, 01 Jul 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 07:30:00 +0000

Type Values Removed Values Added
Title Chrome File System Policy Bypass Allowing Access Control Escalation
Weaknesses CWE-284

Wed, 01 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Title Chrome File System Policy Bypass Allowing Access Control Escalation
Weaknesses CWE-284

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Insufficient policy enforcement in FileSystem in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-01T13:13:40.009Z

Reserved: 2026-06-29T23:11:32.440Z

Link: CVE-2026-14052

cve-icon Vulnrichment

Updated: 2026-07-01T13:13:28.762Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T00:15:06Z

Weaknesses