Executive brief
Google Chrome's Web Workers implementation contains an authorization flaw that allows remote attackers to bypass the same-origin policy—a fundamental security mechanism that prevents malicious websites from accessing data from other sites. An attacker could craft a malicious HTML page to trick the browser into executing code outside its intended security boundaries, potentially allowing unauthorized access to sensitive information from other web origins.
Technical details
This vulnerability exists in the Workers authorization logic of Google Chrome versions prior to 153.0.8010.36. The flaw permits incorrect authorization decisions, allowing a remote attacker to bypass web origin policy through a crafted HTML page. The attack requires only network-level interaction and user interaction (visiting a malicious website), with no authentication needed. An attacker can exploit this to violate the same-origin policy isolation between web workers, potentially gaining unauthorized access to resources from different origins. The vulnerability is patched in Chrome 153.0.8010.36 and later.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-08: disclosed: Chrome 153.0.8010.36 released with fix