Description

Missing authorization in BrowserTag in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:17:47.070Z",
  "pubdate": "2026-08-25T21:17:47.070Z",
  "executiveSummary": "A security vulnerability categorized as missing authorization exists within the BrowserTag component of Google Chrome prior to version 152.0.7977.65.\nThe vulnerability permits a remote attacker to achieve unauthorized access to sensitive information by leveraging social engineering tactics.\nSuccessful exploitation requires the victim to interact with a crafted Chrome extension, which functions as the primary delivery vector for the exploit.\nWhile the Chromium security severity is rated as Low, the potential for data exfiltration necessitates prompt remediation to ensure browser integrity.\nThe flaw stems from insufficient access control checks within the extension-to-browser communication pathway, allowing an attacker to bypass standard security boundaries.\nEnd-users are at risk of information disclosure if they are induced to install or interact with malicious extensions that exploit this authorization gap.",
  "technicalDetails": "The vulnerability resides within the BrowserTag architecture of the Chromium codebase, which handles the rendering and management of embedded browser instances or specific tag-based features. The root cause is a deficiency in the authorization enforcement logic, specifically regarding the handling of cross-context requests originating from installed extensions.\nIn the Chromium architecture, extensions typically operate within a strictly defined privilege boundary. The missing authorization check allows a crafted extension to perform operations or access data structures that should be restricted to privileged browser components or authorized origins. Because the BrowserTag component fails to validate the caller's authorization token or security context effectively, a malicious extension can issue requests to internal APIs or intercept data flows that are normally isolated.\nThe attack flow begins with the deployment of a malicious or compromised Chrome extension. Through social engineering—such as masquerading as a legitimate utility or productivity tool—the attacker induces a user to install the extension. Once installed, the extension utilizes the BrowserTag interface to target specific sensitive data streams. Because the authorization verification is absent at the BrowserTag boundary, the extension is granted implicit trust to interact with browser-managed resources that it should not otherwise reach.\nThe exploitation method leverages the existing browser extension API surface to interact with the vulnerable BrowserTag component. By invoking specific methods within the BrowserTag context, the malicious code bypasses the security checks intended to enforce user-mediated consent or origin-based scoping. The payload behavior involves the extraction of this sensitive information, which is subsequently exfiltrated to an attacker-controlled remote server.\nThis vulnerability is persistent for all Google Chrome versions strictly prior to 152.0.7977.65. The impact is categorized as sensitive information disclosure, which could include browsing metadata, session-related artifacts, or other data processed by the BrowserTag instance during the attack lifecycle. There is no requirement for elevated local privileges on the host operating system; the compromise is contained within the context of the browser application itself."
}