CVE-2026-103626 is an incorrect authorization vulnerability affecting the FileSystem feature in Google Chrome on Windows platforms before version 154.0.8037.97. This flaw enables a remote attacker, using social engineering techniques, to execute arbitrary code outside the browser sandbox via a specially crafted HTML page. The vulnerability has been assigned a high severity rating by the Chromium security team. Google has issued a stable channel update to fix this issue as referenced in their official advisory.

Successful exploitation could allow a remote attacker to execute arbitrary code outside the sandbox environment, potentially compromising the affected system. The attack requires social engineering to lure the victim to a maliciously crafted HTML page. This elevates the risk of code execution beyond the browser sandbox, increasing the potential damage.

Google has released an official stable channel update for Chrome that addresses this vulnerability. Users should update their Chrome browsers to version 154.0.8037.97 or later to mitigate this issue. No additional mitigation steps are required beyond applying the official update.