Executive brief
Google Chrome contains a security flaw in its network handling that allows an attacker to bypass same-origin policy protections. An attacker can craft a malicious webpage that tricks Chrome into leaking data from other websites or services a user is logged into, potentially exposing sensitive information without user interaction.
Technical details
This vulnerability is a cross-origin data disclosure flaw in Chrome's Network component prior to version 153.0.8010.36. It is triggered via a crafted HTML page that exploits an observable discrepancy in network behavior to extract cross-origin data that should be protected by browser same-origin policy. The attack is remote and requires no authentication or special user interaction beyond visiting the attacker's malicious webpage. An attacker can retrieve sensitive data from cross-origin requests, compromising the confidentiality of user data across different websites. The vulnerability is fixed in Chrome 153.0.8010.36 and later.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched