Executive brief
Google Chrome's Prerender feature contains a logic flaw that could allow an attacker who has already compromised the browser's renderer process to bypass web origin policies—security boundaries that prevent one website from accessing another's data. This means a compromised renderer could trick the browser into loading content from one origin while claiming to be from another, potentially exposing sensitive information or enabling malicious actions across website boundaries.
Technical details
This is a confused deputy vulnerability in Chrome's Prerender component. The vulnerability occurs when a remote attacker has already compromised the renderer process and can craft a malicious HTML page to exploit insufficient authorization checks in the Prerender logic. The attack allows bypassing the web origin policy (same-origin policy), which is the fundamental security boundary preventing cross-origin access. An attacker would need control over the renderer process as a precondition. The fix is available in Chrome 153.0.8010.36 and later versions.
Affected products
- Google Chrome before 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched: Chrome 153.0.8010.36 released