Description

Information leak in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:17:58.350Z",
  "pubdate": "2026-08-25T21:17:58.350Z",
  "executiveSummary": "This vulnerability is an information disclosure flaw identified in the ServiceWorker component of the Google Chrome browser. The vulnerability allows a remote attacker to bypass security boundaries and exfiltrate sensitive data by leveraging a specially crafted HTML page. The vulnerability is classified by Chromium as having a Medium severity level.\nThe core risk involves the potential for unauthorized access to sensitive information that should otherwise be protected by the browser's origin-based security model. By convincing a user to navigate to a malicious web page, an attacker can trigger the vulnerability to compromise data integrity and confidentiality.\nThe vulnerability affects versions of Google Chrome prior to 152.0.7977.65. Successful exploitation does not require advanced administrative privileges on the host system, but it does necessitate user interaction by visiting the attacker-controlled resource. As this is a client-side vulnerability, the potential for widespread impact is high, particularly for users handling sensitive credentials or private session data within the browser environment. The flaw underscores a breakdown in the secure isolation mechanisms governing the ServiceWorker lifecycle and its interaction with cross-origin or sensitive data contexts.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper implementation of security controls within the ServiceWorker API integration in Chromium. ServiceWorkers are powerful event-driven scripts that act as proxy servers between web applications, the browser, and the network. Due to a flaw in how the browser handles requests or state management initiated by the ServiceWorker, it is possible for a crafted HTML document to intercept or exfiltrate data that would normally be restricted by the Same-Origin Policy (SOP).\nThe attack flow begins when a user navigates to an attacker-controlled HTML page. This page contains malicious JavaScript designed to register or interact with a ServiceWorker in a specific, non-standard way that exploits the vulnerability during the request intercept or response processing phase. Because ServiceWorkers operate in a separate execution context, they are often trusted with managing cache and network requests. The vulnerability allows the attacker to induce the ServiceWorker to perform actions that leak data from the current origin or from other contexts that the browser incorrectly assumes are isolated.\nThe exploitation method leverages the browser's ServiceWorker architecture to bypass standard memory or data isolation boundaries. When the browser processes a request through the vulnerable ServiceWorker, the malicious code forces the worker to return sensitive information in the response, which is then captured by the attacker's HTML page. This effectively turns the browser's own proxy mechanism into a tool for data exfiltration. The vulnerability exists within the browser's internal logic governing how ServiceWorker responses are validated against the requestor's origin.\nAffected versions include all iterations of Google Chrome prior to 152.0.7977.65. The flaw is exploitable via a standard network-accessible web page, meaning no specific authentication or local system access is required by the attacker. Upon successful exploitation, the post-exploitation impact includes the exposure of cookies, session tokens, or other sensitive user data that may be present in the origin associated with the worker. By accessing this information, an attacker can potentially escalate to session hijacking or further compromise of the user's account security."
}