Executive brief
Google Chrome's PushAPI feature is used to manage push notifications in web applications. A renderer process compromise could allow an attacker to bypass web origin policy restrictions via a crafted HTML page, potentially enabling unauthorized access to push notifications from other web origins.
Technical details
This vulnerability is an incorrect authorization flaw in Chrome's PushAPI component affecting versions prior to 153.0.8010.36. The attack requires a compromised renderer process as a precondition and allows an attacker to bypass web origin policy through a crafted HTML page. The vulnerability permits unauthorized cross-origin access to push notification functionality. The fix is available in Chrome 153.0.8010.36 and later versions for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched: Chrome 153.0.8010.36 released