Description

Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:17:59.470Z",
  "pubdate": "2026-08-25T21:17:59.470Z",
  "executiveSummary": "A security vulnerability categorized as incorrect authorization exists within the WebProtect component of Google Chrome prior to version 152.0.7977.65.\nThis vulnerability allows a remote, unauthenticated attacker to bypass established security boundaries and gain unauthorized access to sensitive information.\nThe flaw stems from an authorization failure within the browser's internal WebProtect mechanisms, which should strictly control access to restricted data or system resources.\nBy leveraging a specially crafted HTML page, an attacker can coerce the browser into disclosing sensitive data that would otherwise be protected from external web content.\nThe Chromium project has classified this vulnerability with a Medium severity rating, reflecting the potential for data leakage and unauthorized information disclosure.\nSuccessful exploitation requires the victim to interact with malicious web content, typically by navigating to a site controlled or influenced by the attacker.\nThe impact is primarily focused on confidentiality loss, where an attacker may retrieve sensitive local information or session-related data via the browser's context.\nUsers and organizations are strongly encouraged to upgrade to the specified patched version or later to eliminate the risk of unauthorized data exposure through this vector.",
  "technicalDetails": "The vulnerability is rooted in an incorrect authorization implementation within the WebProtect module of Google Chrome. WebProtect serves as a security layer designed to manage, monitor, or restrict interactions between web pages and the underlying browser architecture or sensitive local resources.\nThe flaw manifests when the authorization logic fails to properly validate the origin or security context of an incoming request initiated by a rendered HTML page. In this context, the browser's authorization checks are insufficient to distinguish between legitimate internal calls and requests originating from potentially untrusted or malicious cross-origin content.\nExploitation is achieved via a crafted HTML page designed to interact with the vulnerable WebProtect component. When a user navigates to the attacker's page, the crafted document executes scripts or triggers browser behaviors that interact with the WebProtect API or interface. Because the authorization check is flawed, the browser improperly honors these requests, assuming the caller has the necessary privileges to access the requested resource.\nThe attack flow follows these steps: 1) The attacker hosts a malicious HTML page containing specific scripts or tags designed to target the WebProtect subsystem. 2) The victim user is lured into navigating to this site. 3) Upon rendering, the malicious HTML performs a request to the vulnerable component. 4) The WebProtect subsystem performs an inadequate authorization check, incorrectly verifying the request's legitimacy. 5) The component returns restricted or sensitive data to the attacker-controlled page context. 6) The attacker exfiltrates the captured information via asynchronous network requests (e.g., fetch or XMLHttpRequest) to a remote server.\nThis vulnerability does not require authentication or elevated privileges on the target system, as it operates within the context of the user's browser session. The primary requirement is user interaction, making it a high-risk vector for remote information harvesting. The lack of robust origin validation or scope restriction in the WebProtect component allows the bypass, directly impacting the integrity of the browser's security boundary. The post-exploitation impact includes the potential theft of sensitive data, such as session cookies, cached credentials, or local site data, depending on the scope of the information accessible to the vulnerable WebProtect function.\nThis issue is addressed in Google Chrome versions 152.0.7977.65 and above, where the authorization logic has been hardened to ensure strict validation of all calls into the WebProtect interface, thereby preventing unauthorized access from untrusted HTML sources."
}