Description

Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:17:48.140Z",
  "pubdate": "2026-08-25T21:17:48.140Z",
  "executiveSummary": "A vulnerability classified as incorrect authorization exists within the WebProtect component of Google Chrome prior to version 152.0.7977.65.\nThe flaw permits a remote attacker to conduct unauthorized information disclosure by leveraging a maliciously crafted HTML page.\nThis vulnerability is rated as Medium severity within the Chromium security framework.\nThe risk involves the potential leakage of sensitive data residing within the browser's context or local environment.\nSuccessful exploitation requires the victim to navigate to or interact with an attacker-controlled web resource.\nNo explicit user authentication is required by the attacker to initiate the exploitation process; however, the attack vector relies on the execution of malicious script or markup within the renderer process.\nThe primary impact is the unauthorized exposure of protected information, which may include cross-origin data or local system identifiers, depending on the scope of the authorization bypass.",
  "technicalDetails": "The vulnerability originates from an incorrect authorization check within the WebProtect component, which is responsible for mediating access to sensitive browser features or internal data structures. In the affected versions of Chromium (prior to 152.0.7977.65), the security boundary intended to restrict access to WebProtect-gated information failed to properly validate the caller's context or origin.\nThe root cause is a failure in the authorization logic, likely involving a flawed check within the security boundary layer that manages inter-process communication or internal API access. By failing to verify if the requester has sufficient privileges to access sensitive resources, the component inadvertently exposes functionality to untrusted content hosted on a remote server.\nThe exploitation flow typically follows these steps: First, an attacker hosts a malicious HTML page containing specifically crafted tags or scripts designed to trigger the vulnerable WebProtect interface. Second, when a victim navigates to this page, the browser's renderer process attempts to interact with the WebProtect component. Due to the authorization flaw, the component accepts the request without correctly enforcing origin-based security policies or privilege requirements. Third, the interaction results in the leakage of sensitive information, which the attacker then exfiltrates to an external server via asynchronous network requests (e.g., fetch, XHR, or WebSocket).\nBecause this vulnerability resides in the renderer process's ability to communicate with higher-privilege browser components, the attack circumvents standard Same-Origin Policy (SOP) protections that would otherwise prevent a site from accessing unauthorized cross-origin resources. The attack does not require prior knowledge of the victim's local system, as the exploit is fully delivered through the web content. The persistent state of the browser, such as cookies, sessions, or saved credentials, might be exposed if the WebProtect component has access to such caches.\nThe scope of the impact is constrained by the permissions afforded to the WebProtect component itself. If the component possesses broad access to internal browser APIs, the potential for data exfiltration increases, potentially allowing an attacker to bypass privacy protections. Post-exploitation, the attacker may use the leaked information to facilitate further attacks, such as session hijacking or targeted phishing based on the harvested sensitive data."
}