CVE-2026-0903: Google Chrome Auth Bypass Vulnerability

CVE-2026-0903 Overview

CVE-2026-0903 is an Improper Input Validation vulnerability affecting the Downloads component in Google Chrome on Windows prior to version 144.0.7559.59. The vulnerability stems from an inappropriate implementation that allows a remote attacker to bypass dangerous file type protections via a malicious file. This security flaw enables attackers to potentially deliver malicious payloads to users by circumventing Chrome's built-in file safety mechanisms.

Critical Impact
Remote attackers can bypass Chrome's dangerous file type protections, potentially enabling delivery of malicious executables or scripts to unsuspecting users through social engineering attacks.

Affected Products

Google Chrome on Windows prior to version 144.0.7559.59
Chromium-based browsers on Windows using affected codebase

Discovery Timeline

2026-01-20 - CVE-2026-0903 published to NVD
2026-01-20 - Last updated in NVD database

Technical Details for CVE-2026-0903

Vulnerability Analysis

The vulnerability resides in Google Chrome's Downloads component, specifically in how the browser handles file type validation during the download process. Chrome implements security measures to warn users about potentially dangerous file types (such as .exe, .bat, .cmd, and other executable formats), but this implementation flaw allows attackers to craft malicious files that evade these protections.

The root cause is classified as CWE-20 (Improper Input Validation), indicating that the browser fails to properly validate or sanitize certain file attributes before making security decisions about the download. This could involve manipulation of file headers, MIME types, file extensions, or other metadata that Chrome uses to determine if a file should trigger a security warning.

Root Cause

The vulnerability is caused by improper input validation in the Downloads component's file type detection logic. Chrome's security model relies on accurately identifying potentially dangerous files to warn users before execution. When this validation is flawed, attackers can disguise malicious files to bypass the protection mechanisms. The inappropriate implementation suggests that certain edge cases or malformed file attributes are not being handled correctly, allowing dangerous files to be treated as safe.

Attack Vector

The attack requires user interaction, as the victim must be enticed to download a malicious file. A typical attack scenario involves:

An attacker hosts a specially crafted malicious file on a web server
The victim is lured to download the file through phishing, malvertising, or compromised websites
Due to the vulnerability, Chrome fails to recognize the file as dangerous
The file downloads without the appropriate security warnings
The victim may then execute the file, believing it to be safe

The attack is network-based and requires no special privileges on the target system. The user must interact by downloading and potentially executing the malicious file, which explains the medium severity rating assigned by Chromium security.

Detection Methods for CVE-2026-0903

Indicators of Compromise

Unexpected executable files appearing in download directories without corresponding Chrome security warnings
Browser history showing downloads from suspicious or newly registered domains
Downloaded files with mismatched extensions and actual file types
Chrome download events where dangerous file warnings were not triggered for executable content

Detection Strategies

Monitor Chrome browser version across endpoints to identify systems running versions prior to 144.0.7559.59
Implement endpoint detection rules for executable files downloaded without triggering Chrome's SafeBrowsing warnings
Analyze downloaded file metadata for signs of extension or MIME type manipulation
Deploy network monitoring to detect downloads of files with suspicious header or metadata characteristics

Monitoring Recommendations

Enable Chrome browser telemetry and audit logging for download events
Configure SIEM alerts for executable downloads on Windows endpoints running vulnerable Chrome versions
Implement file integrity monitoring on common download directories
Review Chrome Enterprise policies to ensure download restrictions are properly configured

How to Mitigate CVE-2026-0903

Immediate Actions Required

Update Google Chrome to version 144.0.7559.59 or later immediately on all Windows systems
Enable automatic Chrome updates to ensure future patches are applied promptly
Review recent downloads on affected systems for potentially malicious files
Reinforce user awareness about the risks of downloading files from untrusted sources

Patch Information

Google has released a security patch in Chrome version 144.0.7559.59 that addresses this vulnerability. The fix is included in the stable channel update released on January 13, 2026. Organizations should prioritize updating Chrome across all Windows endpoints. For detailed information about the patch, refer to the Google Chrome Release Update and the Chromium Issue Tracker #444803530.

Workarounds

Implement additional endpoint protection to scan all downloaded files regardless of Chrome's warnings
Configure Chrome Enterprise policies to block downloads of high-risk file types
Deploy network-level file inspection to detect and block potentially malicious downloads
Use application whitelisting to prevent execution of unauthorized executables

bash

# Chrome Enterprise policy to restrict dangerous downloads
# Add to Chrome policy template or registry
# Windows Registry path: HKLM\SOFTWARE\Policies\Google\Chrome
# DownloadRestrictions: 1 = Block dangerous downloads

reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v DownloadRestrictions /t REG_DWORD /d 1 /f