Executive brief
Google Chrome's browser component failed to properly validate user authorization when accessing privileged pages. An attacker could craft a malicious web page and use social engineering to trick users into visiting it, allowing bypass of web origin security policies to access restricted functionality. This could enable account compromise or unauthorized access to sensitive browser features.
Technical details
The vulnerability is a missing authorization check in Chrome's Browser component that allows improper access to privileged pages. The vulnerability class is authorization bypass / missing access control. An attacker must craft a malicious HTML page and use social engineering to get a user to visit it (requires user interaction). By exploiting weak origin policy enforcement, the attacker can bypass same-origin policy restrictions and gain access to functionality that should require explicit authorization. The issue was patched in Chrome 152.0.7977.65 and later versions.
Affected products
- Google Chrome prior to 152.0.7977.65 on macOS
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Chrome 152.0.7977.65 and later