Description

Missing authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially spoof address bar via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:17:52.993Z",
  "pubdate": "2026-08-25T21:17:52.993Z",
  "executiveSummary": "This vulnerability involves a missing authorization flaw within the Core component of Google Chrome. The vulnerability allows a remote attacker who has already successfully compromised the renderer process to perform address bar spoofing via a specially crafted HTML document.\nThe vulnerability is classified as Low severity by the Chromium security team. By manipulating the address bar, an attacker can mislead users regarding the origin or identity of the webpage they are viewing, facilitating phishing or social engineering attacks.\nThe exploit requires an attacker to have achieved an initial compromise of the renderer process, which typically implies chaining this flaw with a separate exploit (e.g., a memory corruption bug) to gain code execution within the sandbox.\nThe scope of impact is limited to browsers prior to version 152.0.7977.65. Organizations and users are advised to update to the patched version immediately to mitigate potential exploitation of the rendering pipeline.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper authorization check within the Chromium Core component. In the browser architecture, the renderer process is responsible for parsing and rendering web content, while the browser process (the privileged layer) manages security-sensitive UI elements, including the address bar (omnibox).\nUnder normal operating conditions, the browser process maintains strict control over the navigation state and the URL display. However, due to the identified missing authorization, the browser process fails to adequately validate or restrict requests originating from a compromised renderer process when updating the address bar state. This allows the renderer to bypass security policies that are intended to prevent the falsification of the displayed URL.\nThe attack flow follows a multi-stage progression. First, an attacker must successfully compromise the renderer process via a separate exploit, such as a heap overflow or use-after-free, allowing the execution of arbitrary JavaScript within the sandbox. Once code execution is achieved in the renderer, the attacker can leverage the missing authorization flaw in the Core component to communicate malicious instructions to the browser process or manipulate internal state variables that govern the omnibox display.\nThe attacker crafts a malicious HTML page that initiates navigation or UI update events while simultaneously spoofing the expected URL display logic. Because the Core component lacks the necessary authorization check, the browser process accepts these forged instructions as legitimate. Consequently, the browser reflects a URL of the attacker's choosing in the address bar, while the underlying document remains controlled by the attacker. This discrepancy effectively hides the true origin of the content from the end-user.\nThe impact of this successful spoofing includes the potential for highly convincing phishing attacks, as the user is led to believe they are interacting with a trusted domain. Furthermore, it undermines the integrity of the browser's security indicators, which rely on the omnibox to provide accurate context regarding the site's origin, identity, and security status. The vulnerability is contained within versions of Google Chrome prior to 152.0.7977.65, necessitating a patch to enforce stricter IPC (Inter-Process Communication) validation between the renderer and browser processes."
}