Executive brief
Google Chrome is a web browser used by millions of people to access websites and web applications. A flaw in how Chrome handles web origin policy allows an attacker to bypass security protections that prevent malicious websites from accessing data from other sites. An attacker could craft a malicious HTML page that tricks the browser into allowing unauthorized cross-site access, potentially exposing user data or compromising web application security.
Technical details
This vulnerability is an incorrect authorization flaw in Chrome's Network component that permits attackers to bypass the same-origin policy via a specially crafted HTML page. The same-origin policy is a critical browser security mechanism that prevents scripts from one website from accessing sensitive data from another. The attack requires only that a user visit a malicious webpage; no authentication or additional user interaction is needed beyond viewing the page. An attacker exploiting this can access data across origins that should be protected by the browser's security model. The vulnerability was patched in Chrome 152.0.7977.65, released on August 25, 2026.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Chrome 152.0.7977.65 released