Executive brief
A vulnerability exists in Google Chrome's implementation of Cross-Origin Resource Sharing (CORS), a security mechanism that controls how web resources are accessed across different domains. If an attacker has already compromised a browser's rendering process, they could use this flaw to bypass security boundaries and steal sensitive data from other websites the user has open. This could lead to the unauthorized exposure of personal information or session data from unrelated web services.
Technical details
An inappropriate implementation vulnerability exists in the Cross-Origin Resource Sharing (CORS) component of Google Chrome. The flaw allows a remote attacker to bypass cross-origin data protections. The attack requires a precondition where the attacker has already compromised the renderer process. By utilizing a specially crafted HTML page, the attacker can then leak data across origins that should otherwise be isolated. This issue was addressed in Chrome version 151.0.7922.72.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: patched: Fixed in version 151.0.7922.72
- 2026-07-30: disclosed