Executive brief
Google Chrome's Loader component contained an authorization flaw that allowed remote attackers to bypass the web origin policy—a fundamental security boundary that prevents malicious websites from accessing data or functionality of legitimate sites. An attacker could exploit this by crafting a malicious HTML page, potentially gaining unauthorized access to sensitive information or performing actions outside their intended origin.
Technical details
This vulnerability is an incorrect authorization flaw in Chrome's Loader component that allows bypass of the same-origin policy (SOP), a core browser security mechanism. The attack vector is remote and requires only crafted HTML content; no user interaction beyond visiting the malicious page or clicking a link is needed. An attacker can craft a specially designed HTML page that exploits this authorization logic to access resources or perform operations across web origins that should be isolated from each other. The vulnerability was fixed in Chrome 152.0.7977.65, released on August 25, 2026.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed: Fixed in Chrome 152.0.7977.65 (Windows/Mac) and 152.0.7977.64 (Linux)
- 2026-08-25: other: CVE-2026-79051 assigned