Executive brief
Google Chrome is a widely used web browser that processes HTML and web content. A flaw in the Editing component allows an attacker who has already compromised the browser's renderer process to bypass web origin security policies through a specially crafted HTML page combined with social engineering. This could enable unauthorized access to data or functionality from other websites.
Technical details
The vulnerability is an improper input validation flaw in Chrome's Editing component. It requires two preconditions: the attacker must have already compromised the renderer process (a sandboxed component that parses and renders web content), and must use social engineering to trick the user into interacting with a crafted HTML page. Successful exploitation allows bypassing the browser's web origin policy (same-origin policy), which normally prevents scripts from one website from accessing data from another. The vulnerability has been fixed in Chrome 152.0.7977.65 and later versions.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65