Executive brief
Google Chrome's ReaderMode feature contains a flaw that allows remote attackers to bypass security controls protecting sensitive browser pages. An attacker using social engineering to trick a user into visiting a malicious webpage can escape the browser's normal security boundaries and access privileged page content, potentially compromising user data or browser functionality.
Technical details
The vulnerability is an improper input validation flaw in Chrome's ReaderMode component. The root cause lies in insufficient validation of HTML input when rendering content in ReaderMode, which allows malicious HTML to bypass the Same-Origin Policy (web origin policy) that normally prevents unprivileged pages from accessing privileged browser content. An attacker must craft a malicious HTML page and use social engineering to convince a user to visit it; when loaded in ReaderMode, the crafted page can gain access to privileged page resources. The vulnerability was patched in Chrome 152.0.7977.65 released on August 25, 2026. No active exploitation in the wild has been reported.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed: Fixed in Chrome 152.0.7977.65 stable release