CVE-2026-0903

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2026-01-20

Last updated on: 2026-01-29

Assigner: Chrome

Description

Inappropriate implementation in Downloads in Google Chrome on Windows prior to 144.0.7559.59 allowed a remote attacker to bypass dangerous file type protections via a malicious file. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-20

Last Modified

2026-01-29

Generated

2026-07-06

AI Q&A

2026-01-20

EPSS Evaluated

2026-07-05

NVD

CVE-2026-0903

EUVD

EUVD-2026-3454

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 144.0.7559.59 (exc)
linux	linux_kernel	*
microsoft	windows	*
google	chrome	to 144.0.7559.60 (exc)
apple	macos	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability is due to an inappropriate implementation in the Downloads feature of Google Chrome on Windows versions prior to 144.0.7559.59. It allows a remote attacker to bypass protections that are meant to block dangerous file types by using a malicious file.

Impact Analysis

The vulnerability can impact you by allowing a remote attacker to bypass file type protections in Google Chrome downloads, potentially leading to the download and execution of harmful files on your system.

Mitigation Strategies

Update Google Chrome on Windows to version 144.0.7559.59 or later to ensure the vulnerability is patched and dangerous file type protections are properly enforced.

Hi! I’m here to help you understand CVE-2026-0903. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70