Executive brief
Google Chrome's Speech component contains a logic flaw that can be exploited by attackers who have already compromised the browser's renderer process. By crafting a malicious HTML page, an attacker can bypass Chrome's site isolation security boundary—a key protection that prevents websites from accessing data from other sites. This could allow a compromised attacker to steal data from other open websites.
Technical details
The vulnerability is an incorrect reference resolution flaw in the Speech component of Google Chrome prior to version 152.0.7977.65. The attack requires an attacker to have already compromised the renderer process; the attacker then crafts a specially designed HTML page that exploits the reference resolution logic to bypass site isolation. Site isolation is a crucial security mechanism that isolates each website in its own process, preventing cross-site data access. By circumventing this boundary, an attacker with renderer control can potentially access sensitive data from other websites the user has open. The vulnerability is patched in Chrome 152.0.7977.65 and later.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed: Published in Chrome 152 stable release notes
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65