Executive brief
Google Chrome's DevTools component failed to properly validate permissions, allowing a malicious browser extension to access sensitive cross-origin data that should have been restricted. An attacker could exploit this by tricking a user into installing a crafted extension, potentially exposing confidential information from websites the user visits.
Technical details
This is an authorization bypass vulnerability in Chrome's DevTools. A missing or insufficient authorization check in the DevTools interface allows a remote attacker (via a crafted Chrome extension) to access cross-origin data that should be protected. The attack requires user interaction (installing a malicious extension) and local/adjacent network access via the extension mechanism. A successful exploit results in unauthorized data disclosure across security boundaries, violating the same-origin policy. The vulnerability was fixed in Chrome 153.0.8010.36, released September 8, 2026.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in Chrome 153.0.8010.36