Executive brief
A security vulnerability has been identified in Google Chrome's DevTools, a set of web developer tools built directly into the browser. A remote attacker could use a specially crafted website to bypass the browser's Same Origin Policy, which is a fundamental security mechanism that prevents websites from accessing data from other sites. If exploited, this could allow an attacker to potentially access sensitive information or interact with other open websites without the user's permission.
Technical details
A Same Origin Policy (SOP) bypass vulnerability exists in the DevTools component of Google Chrome. The flaw stems from an inappropriate implementation within the developer tools interface, which fails to strictly enforce origin boundaries when processing certain inputs. A remote attacker can exploit this by enticing a user to visit a maliciously crafted HTML page. Successful exploitation allows the attacker to bypass SOP restrictions, potentially leading to unauthorized cross-origin data access or interaction with other web sessions. The issue is addressed in Google Chrome version 151.0.7922.72.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: patched: Fixed in Chrome Stable channel update 151.0.7922.72
- 2026-07-30: disclosed: NVD publication date