Executive brief
Google Chrome's Contacts feature did not properly validate user permissions, allowing an attacker with control over the browser's internal rendering process to access sensitive contact information. An exploit requires the attacker to first compromise the renderer process and trick a user into visiting a crafted web page. Successfully exploiting this could expose stored personal contact data.
Technical details
This vulnerability is a missing authorization check in Chrome's Contacts component. The vulnerability requires two preconditions: the attacker must first achieve remote code execution in the renderer process, and then socially engineer the user to visit a malicious HTML page. Once both conditions are met, the attacker can bypass authorization controls to read sensitive information from the Contacts system. The issue was assigned a Low severity rating by the Chromium security team, though CVSS scoring reflects medium risk. The vulnerability was fixed in Chrome 153.0.8010.36 released on September 8, 2026.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched