Description

Missing authorization in Browser in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-25T21:17:59.800Z",
  "pubdate": "2026-08-25T21:17:59.800Z",
  "executiveSummary": "A missing authorization vulnerability exists within Google Chrome on Mac prior to version 152.0.7977.65, potentially allowing a remote attacker to circumvent web origin policy enforcement.\nThis vulnerability is classified as a low-severity security flaw that facilitates unauthorized access to privileged web pages.\nThe attack vector necessitates the employment of social engineering techniques to deceive a user into interacting with a specifically crafted HTML page.\nSuccessful exploitation enables a remote attacker to transcend standard browser sandbox restrictions, granting unauthorized access to internal or privileged browser origins that should otherwise be isolated.\nThe primary risk implications involve the potential for cross-origin information disclosure or unauthorized execution of functions within a privileged context.\nThis issue highlights a failure in the browser's authorization logic when managing cross-origin requests, emphasizing the critical nature of maintaining strict boundary enforcement between different web origins.",
  "technicalDetails": "The root cause of this vulnerability is an improper authorization check within the browser's origin enforcement logic for specific internal pages on the Mac platform. The Web Origin Policy is a fundamental security mechanism designed to prevent documents or scripts loaded from one origin from interacting with resources or scripts from a different origin.\nIn this instance, the browser failed to adequately validate the authorization context when a cross-origin request was directed toward a privileged page. This deficiency allows an attacker, by leveraging social engineering, to craft a malicious HTML document that, when rendered, can bypass the security boundaries normally enforced by the browser engine.\nThe attack flow begins when an attacker hosts a crafted HTML page designed to initiate a navigation or resource request to a restricted, privileged browser-internal page. The attacker must use social engineering tactics—such as phishing or deceptive UI prompts—to entice the user to visit or interact with the malicious site. Once the malicious content is rendered, the vulnerable authorization logic fails to properly vet the request origin against the target page's security constraints.\nBecause the browser fails to verify the authorization for the transition into the privileged context, the attacker is able to manipulate the browser into executing operations or accessing data within a privileged origin. This behavior essentially negates the sandbox protections intended to isolate highly sensitive browser components from potentially untrusted web content.\nThe scope of this vulnerability is limited to Google Chrome on Mac versions prior to 152.0.7977.65. The exploit is remote in nature, as it is triggered through web content processing, but it requires the target user to navigate to the attacker-controlled page, fulfilling the prerequisite for social engineering. Once the origin policy is bypassed, the attacker effectively operates within the security context of the privileged page, which may allow for unauthorized data access or the interaction with restricted browser internal APIs, depending on the functionality of the compromised page."
}