Executive brief
Google Chrome's extension system contained an authorization flaw that allowed attackers to bypass security restrictions and access privileged pages. A user visiting a crafted malicious webpage could allow an attacker to gain unauthorized access to sensitive browser functionality normally restricted to trusted extensions, potentially exposing sensitive user data or allowing further system compromise.
Technical details
This vulnerability is an incorrect authorization flaw in Google Chrome's Extensions subsystem (CWE-863). The root cause involves insufficient validation of access controls when extensions or web pages attempt to access privileged functionality. An unauthenticated remote attacker can craft a malicious HTML page that, when visited by a user, bypasses system access restrictions and gains unauthorized access to privileged pages normally protected from web content. The attack requires user interaction (visiting the malicious page) and network reachability. Google patched this issue in Chrome 153.0.8010.36 and later versions. Chromium assessed this as low severity, though the reported CVSS score is significantly higher.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched