Executive brief
Google Chrome includes a resource preloading feature that failed to properly validate permissions before loading resources from different web origins. This missing authorization check allows an attacker to craft a malicious HTML page that bypasses the browser's same-origin policy, potentially exposing sensitive data or performing actions on behalf of users without proper consent.
Technical details
This vulnerability is a missing authorization flaw in the Preload component of Google Chrome prior to version 152.0.7977.65. The issue allows a remote attacker to bypass the web origin policy through a crafted HTML page, exploiting the browser's resource preloading mechanism which did not properly validate authorization before fetching cross-origin resources. The attack is network-based and requires user interaction (visiting a malicious page). An attacker can use this to access or manipulate resources across different web origins, violating the same-origin security model. The vulnerability was patched in Chrome 152.0.7977.65 or later.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65