Executive brief
Google Chrome's ServiceWorker component failed to properly enforce web origin policy, allowing attackers to bypass security boundaries via a malicious browser extension when a user is socially engineered into installing it. This could permit unauthorized access to sensitive website data or functionality that should be isolated from extensions.
Technical details
The vulnerability is an incorrect authorization flaw in Chrome's ServiceWorker implementation that fails to properly enforce same-origin policy. An attacker can craft a malicious Chrome extension and use social engineering to trick a user into installing it, then leverage the authorization bypass to access resources or functionality protected by web origin policy. The vulnerability requires user interaction (installing an extension) but runs with network reachability. The flaw was patched in Chrome 152.0.7977.65 and later versions.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65