Executive brief
Google Chrome's FileSystem component has a missing authorization flaw that could allow an attacker with a compromised renderer process to access data across different websites. An attacker could exploit this by tricking a user into visiting a malicious webpage, potentially exposing sensitive information from other websites the user is logged into.
Technical details
The vulnerability is a missing authorization check in Chrome's FileSystem implementation (CWE-862). An attacker who has compromised the renderer process can bypass authorization checks to read cross-origin data via a crafted HTML page. While the attack requires prior compromise of the renderer process (via another vulnerability or attack), successful exploitation allows unauthorized access to FileSystem data from different origins. The flaw was patched in Chrome 153.0.8010.36, released September 8, 2026.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched: Chrome 153.0.8010.36