Description

Information leak in FoldableAPIs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:17:57.637Z",
  "pubdate": "2026-08-25T21:17:57.637Z",
  "executiveSummary": "This vulnerability involves an information leak within the FoldableAPIs component of Google Chrome, affecting versions prior to 152.0.7977.65. The flaw is classified as an information disclosure issue, where an attacker can bypass security boundaries to access sensitive data.\nThe vulnerability allows a remote attacker to exfiltrate information by leveraging a specially crafted HTML page. Although the Chromium security severity is rated as Low, the implication is that the browser fails to properly restrict access to internal API state or device-specific properties when queried by a malicious web context.\nSuccessful exploitation does not require advanced privileges or authentication from the user, other than visiting a malicious URL. The primary risk involves the unauthorized exposure of potentially sensitive environment or device metadata to a remote server, which could be utilized for fingerprinting or mapping internal browser state. This exposure occurs due to improper sanitization or access control logic within the FoldableAPIs implementation, which governs how web pages interact with foldable device hardware interfaces. Users are urged to update to the specified patched version to mitigate this disclosure risk.",
  "technicalDetails": "The vulnerability resides within the FoldableAPIs implementation in the Chromium rendering engine. FoldableAPIs are designed to provide web developers with access to device geometry, hinge angles, and screen configuration states for foldable hardware. The root cause of this vulnerability is an insufficient access control check or an improper disclosure of internal state variables during the execution of API calls requested by an untrusted origin.\nIn a typical attack flow, an attacker hosts a malicious HTML page containing JavaScript that invokes specific methods within the FoldableAPIs interface. When a user navigates to this page, the Chromium renderer processes the API requests. Due to the lack of adequate validation or cross-origin policy enforcement, the API returns sensitive environmental information to the attacker's script rather than restricting the output to authorized contexts.\nThe exploitation process follows a structured sequence: First, the attacker embeds malicious JavaScript within a crafted HTML document that interacts with the window-level or object-level FoldableAPI properties. Second, the browser, failing to verify the security context or the legitimacy of the caller, executes the request. Third, the vulnerability permits the leakage of data—such as internal screen offsets, device hinge status, or other configuration parameters—which the attacker then transmits to an external server via an asynchronous request (e.g., fetch or XMLHttpRequest).\nThis vulnerability is classified as an information disclosure because it facilitates the unauthorized observation of state data that the browser should maintain as private to the user session or the device. Because the FoldableAPIs are exposed to the DOM (Document Object Model), the surface area for this attack is the browser's JavaScript execution environment. An attacker does not require local system access; the vulnerability is triggered entirely through the web platform's standard exposure to external content. Post-exploitation impact is limited by the nature of the data accessible through these APIs, but such leaks are frequently leveraged in sophisticated multi-stage attacks to build unique browser fingerprints or to infer internal device architecture for further targeting.\nThe defect affects all Google Chrome versions prior to 152.0.7977.65. The vulnerability is triggered remotely without requiring specific user interaction beyond navigation to the malicious resource."
}