Description

Incorrect authorization in Workers in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-20T21:17:10.040Z",
  "pubdate": "2026-08-20T21:17:10.040Z",
  "executiveSummary": "An incorrect authorization vulnerability exists within Workers in Google Chrome prior to version 151.0.7922.173.\nThe vulnerability allows a remote attacker who has already compromised the renderer process and successfully leveraged social engineering to completely bypass the web origin policy.\nThe affected product is Google Chrome, specifically the Workers component.\nThis flaw presents high risk implications as it subverts fundamental browser security boundaries, potentially exposing cross-origin data and application states.\nAttacker capabilities require an initial compromise of the renderer process combined with user interaction via social engineering techniques to deliver a crafted HTML page.\nExploitation requirements strictly necessitate that the adversary first achieves remote code execution or arbitrary control within the sandboxed renderer context before leveraging the authorization flaw to escape origin restrictions.",
  "technicalDetails": "The root cause of the vulnerability stems from incorrect authorization logic implemented within Workers in Google Chrome prior to version 151.0.7922.173.\nThe vulnerable component is the Worker execution and origin validation subsystem, which fails to properly enforce boundary checks under specific execution states.\nThe attack flow begins when an attacker achieves an initial compromise of the renderer process, allowing execution within the sandbox context.\nFollowing the renderer compromise, the attacker employs social engineering to entice a user into loading a crafted HTML page.\nUpon rendering the malicious payload, the attacker leverages the compromised renderer process to interact with the Worker subsystem.\nDue to the incorrect authorization checks, the Worker subsystem improperly validates the security context and origin bounds of the incoming requests.\nThis failure allows the attacker to successfully bypass the web origin policy, granting unauthorized access to cross-origin resources and data structures normally protected by Same-Origin Policy enforcement.\nNo network exposure beyond standard web browsing is required, but the attack depends entirely on the sequential chaining of a renderer process compromise and social engineering vectors.\nPost-exploitation impact includes the potential leakage of sensitive cross-origin data, unauthorized interaction with other active origins, and further degradation of client-side isolation guarantees."
}