Executive brief
Google Chrome's DataTransfer feature had an authorization flaw that could allow an attacker who had already compromised the browser's rendering engine to access sensitive information through a malicious webpage. This creates a secondary attack vector for adversaries who have already gained some level of control over the browser process.
Technical details
This vulnerability is an incorrect authorization flaw in Chrome's DataTransfer implementation. The attack requires an attacker to have first compromised the renderer process, then leverage a crafted HTML page to bypass authorization checks and extract sensitive information. The vulnerability was fixed in Chrome 153.0.8010.36 released on September 8, 2026. The attack vector is network-based (delivery of malicious HTML) but requires prior renderer process compromise as a precondition.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched