Executive brief
Google Chrome's Cross-Origin Resource Sharing (CORS) mechanism, which governs what websites can access resources from other domains, contained an authorization bypass vulnerability. An attacker who had already compromised Chrome's renderer process (the component that executes web pages) could use this flaw to bypass web origin policy restrictions via a crafted HTML page, potentially allowing unauthorized access to sensitive cross-origin data.
Technical details
The vulnerability is an incorrect authorization flaw in Chrome's CORS implementation prior to version 153.0.8010.36. The attack requires the renderer process to be already compromised; the attacker then crafts a malicious HTML page to bypass web origin policy protections. This allows unauthorized access to cross-origin resources that should normally be blocked. The fix is available in Chrome 153.0.8010.36 and later for Windows, macOS, and Linux. The Chromium project classified this as medium severity.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in Chrome 153.0.8010.36