Executive brief
Google Chrome's Network component improperly validates user input when processing web pages, allowing attackers to bypass the browser's web origin policy protections. An attacker can craft a malicious HTML page that, when visited, tricks Chrome into allowing unauthorized cross-origin access, potentially exposing user data or enabling session hijacking attacks.
Technical details
This vulnerability is a improper input validation flaw in Chrome's Network component that fails to properly sanitize or validate input related to web origin policy enforcement. The attack vector is network-based and requires only that a user visits a crafted HTML page—no authentication or special privileges are needed. An attacker can exploit this to bypass same-origin policy restrictions and access resources or data from different origins than the current page context. The vulnerability affects Chrome versions prior to 152.0.7977.65, and patches are available in Chrome 152 and later.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65