Chrome Desktop: run code outside the sandbox (fix 157.0.8103.38)

high severity · published 2026-11-03

A remote attacker who has already taken over a browser renderer process may be able to run their own code on the computer outside Chrome's sandbox through crafted network traffic, using an unspecified security flaw in the Desktop component of Chrome on macOS. Chromium rates it High.

Fixed in: 157.0.8103.38

CVE: CVE-2026-121224

Source: NVD

Am I affected?

You are affected if the installed version is older than 157.0.8103.38. Check the version you have and update to 157.0.8103.38 or later. The fixed version is verified against a vendor or advisory source.

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 777 and your operating system.