Executive brief
Google Chrome contains a code injection vulnerability in its XML parsing component that allows attackers to bypass the same-origin policy—a fundamental browser security feature that prevents websites from accessing data from other domains. An attacker could craft a malicious web page that, when visited, executes code with the privileges of a different website, potentially allowing theft of sensitive data or session hijacking.
Technical details
The vulnerability is a code injection flaw in Google Chrome's XML processing logic prior to version 153.0.8010.47. An attacker can craft a malicious HTML page that injects code through XML input, bypassing the browser's web origin policy (same-origin policy). The attack is network-based and requires only that a user visit the attacker's page; no authentication or prior access is needed. Successful exploitation allows an attacker to execute arbitrary code in the context of a different web origin, potentially accessing sensitive data from other domains or performing actions on behalf of the victim. The vulnerability has been patched in Chrome 153.0.8010.47 and later versions.
Affected products
- Google Chrome prior to 153.0.8010.47
Timeline
- 2026-09-15: disclosed
- 2026-09: patched: Fixed in Chrome version 153.0.8010.47