Executive brief
Google Chrome contains a missing authorization vulnerability in its AppManifest component that could allow an attacker to bypass web origin policy protections. An attacker would need to first compromise the renderer process (the component responsible for displaying web pages) and then use social engineering to trick a user into visiting a crafted HTML page. Successfully exploiting this could allow unauthorized access to resources that should be restricted by the browser's security model.
Technical details
This vulnerability is a missing authorization check in the AppManifest component of Google Chrome prior to version 153.0.8010.47. The vulnerability requires an attacker to have already compromised the renderer process and leverages social engineering by presenting a crafted HTML page to the user. The missing authorization check allows the renderer process to bypass web origin policy restrictions. The vulnerability has a Chromium-assigned severity of Medium, though it was initially reported with a CVSS score of 8.1. Patches are available in Chrome 153.0.8010.47 and later versions.
Affected products
- Google Chrome prior to 153.0.8010.47
Timeline
- 2026-09-15: disclosed