Executive brief
Google Chrome versions before 153.0.8010.36 contain a flaw in how it enforces cross-origin resource sharing (CORS) policies. An attacker who compromised the browser's renderer process could bypass web origin restrictions through a crafted HTML page, potentially allowing unauthorized access to data or functionality from other websites. This requires the attacker to already have control of the renderer process, limiting the immediate exposure.
Technical details
This vulnerability is a missing authorization check in the CORS (Cross-Origin Resource Sharing) implementation within Google Chrome. The flaw allows an attacker who has already compromised the renderer process to bypass web origin policy restrictions by crafting a malicious HTML page. The attack vector requires prior renderer process compromise, meaning this is a post-compromise escalation rather than a primary attack surface. The vulnerability was fixed in Chrome version 153.0.8010.36 released on September 8, 2026.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Chrome 153.0.8010.36 released