Executive brief
Google Chrome's Network component failed to properly initialize security checks in versions before 152.0.7977.65, allowing an attacker to bypass the browser's web origin policy (Same-Origin Policy) via a specially crafted HTML page. This could enable an attacker to access data from other websites or perform unauthorized actions on behalf of a user, compromising the security isolation that browsers rely on to protect user data.
Technical details
This vulnerability is an improper initialization flaw in Chrome's Network component that fails to correctly validate the web origin policy. The vulnerability allows a remote attacker to bypass the Same-Origin Policy (SOP) by crafting and serving a malicious HTML page that the victim visits. No authentication or special user interaction beyond viewing the page is required. Successful exploitation enables an attacker to access cross-origin resources or data that should be restricted, potentially exposing sensitive user information or enabling account compromise. The fix is available in Chrome 152.0.7977.65 and later.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65