Executive brief
A vulnerability in Google Chrome's download manager allowed websites to bypass protections designed to prevent multiple simultaneous file downloads. By tricking a user into visiting a specially crafted webpage, an attacker could trigger several automatic downloads without the usual security prompts. This could be used to overwhelm a user with unwanted files or facilitate the delivery of malicious software.
Technical details
This vulnerability is classified as a protection mechanism failure (CWE-693) within the Downloads component of Google Chrome. The flaw stems from an inappropriate implementation that fails to strictly enforce multi-download restrictions when processing specific HTML structures. A remote, unauthenticated attacker can exploit this by hosting a malicious HTML page and inducing a user to visit it. Successful exploitation allows the attacker to bypass the browser's security prompts that normally restrict a site from initiating multiple automatic downloads, potentially leading to the delivery of multiple unsolicited files. The issue was addressed in Chrome version 147.0.7727.55.
Affected products
- Google Chrome prior to 147.0.7727.55
Timeline
- 2026-01-13: disclosed: Reported by Luan Herrera
- 2026-04-07: patched: Fixed in Chrome 147.0.7727.55 release
- 2026-04-08: advisory: CVE published