Executive brief
Google Chrome's extension system contains a flaw that allows remote attackers to bypass the browser's web origin policy, which is a critical security boundary that prevents malicious websites from accessing privileged browser features and user data. An attacker could craft malicious network traffic to exploit this vulnerability and gain unauthorized access to sensitive browser functions and content from restricted sites.
Technical details
This vulnerability is an improper input validation flaw in the Chrome Extensions subsystem that permits bypass of the Same-Origin Policy (SOP). The root cause involves inadequate validation of network traffic before applying origin checks in the extension system. A remote attacker can send crafted network packets to trigger the vulnerability without requiring user interaction or authentication. Successful exploitation allows an attacker to access a privileged page from an unauthorized origin, potentially enabling data theft, session hijacking, or execution of arbitrary actions in the context of protected pages. The vulnerability was patched in Chrome version 153.0.8010.36 (Windows/Mac) and 153.0.8010.36 (Linux).
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-08: patched: Fixed in Chrome 153.0.8010.36