Executive brief
Google Chrome is a web browser used by billions of people to access websites and web applications. A flaw in how Chrome handles input authorization could allow an attacker who has already compromised the browser's renderer process to bypass web origin policies, potentially accessing data or functionality from websites the user is visiting that should be restricted. The vulnerability requires the attacker to have already compromised the renderer process, which limits the immediate attack surface but represents a privilege escalation risk.
Technical details
This vulnerability is an incorrect authorization flaw in the Input component of Google Chrome. The root cause involves improper authorization checks that fail to properly enforce web origin policy boundaries. An attacker who has already achieved code execution in the renderer process can craft a malicious HTML page to bypass origin isolation, potentially allowing cross-origin access to sensitive data or APIs. The attack requires prior compromise of the renderer process (a significant precondition). The vulnerability was patched in Chrome 152.0.7977.65 and later versions.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65