SECURITYHIGHCVE-2026-121030

CVE-2026-121030: Google Chrome DevTools Incorrect Authorization Allows Sandbox Escape

An incorrect authorization flaw in Chrome DevTools before 157.0.8103.38 could let a socially engineered user run code outside the sandbox.

Dylan H.

Security Team

November 4, 2026
2 min read
CVE-2026-121030: Google Chrome DevTools Incorrect Authorization Allows Sandbox Escape

Affected Products

  • Google Chrome versions prior to 157.0.8103.38

Overview

CVE-2026-121030 is an incorrect authorization flaw in DevTools in Google Chrome. Per the NVD entry published November 3, 2026, a remote attacker who leverages social engineering could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Chromium classifies its own security severity as Medium, while the NVD entry carries a CVSS score of 9.6. This article rates the issue High as a middle ground; the sandbox-escape potential is the reason to patch promptly.

Technical Details

FieldValue
CVE IDCVE-2026-121030
ComponentDevTools
WeaknessIncorrect authorization
NVD CVSS9.6
Chromium severityMedium
Attack vectorCrafted HTML page plus social engineering
Fixed inChrome 157.0.8103.38

Details beyond the NVD description have not been published, and no exploitation in the wild is reported in the source material.

Remediation

  1. Update Chrome to 157.0.8103.38 or later (Settings, About Chrome) and relaunch.
  2. Update other Chromium-based browsers (Edge, Brave, Opera, Vivaldi) as their vendors ship the fix.
  3. Train users not to follow prompts from untrusted pages that ask them to open DevTools or paste content into it.
  4. Managed fleets: confirm the version through your endpoint management tooling.

References

  • NVD: CVE-2026-121030