Description

Information leak in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-25T21:18:03.160Z",
  "pubdate": "2026-08-25T21:18:03.160Z",
  "executiveSummary": "A medium-severity information disclosure vulnerability exists in Google Chrome prior to version 152.0.7977.65.\nThe vulnerability resides within the network stack implementation, allowing an attacker who has already achieved arbitrary code execution within the sandboxed renderer process to bypass process isolation boundaries.\nBy leveraging a maliciously crafted HTML page, a remote attacker can exfiltrate sensitive data that should otherwise be protected by the sandbox.\nThe impact involves the unauthorized access to sensitive information, potentially including cross-origin data or internal state details, which could facilitate further exploitation or compromise user privacy.\nSuccessful exploitation requires the attacker to have first compromised the renderer process, typically through a separate chain of vulnerabilities, such as a remote code execution flaw within the browser engine.\nThis vulnerability highlights the challenges in maintaining strict isolation within complex browser architectures, particularly regarding inter-process communication and network resource management.",
  "technicalDetails": "The vulnerability originates from an improper handling of network-related data within the Chromium browser engine, specifically affecting the network stack components utilized by the renderer process.\nUnder normal operating conditions, the Chromium architecture employs a multi-process model where the renderer process is isolated within a sandbox, restricting its access to sensitive system resources and cross-origin data. This flaw permits a bypass of these intended security boundaries.\nThe attack flow initiates when a user is lured to a maliciously crafted HTML page designed to interact with specific, vulnerable network-handling functions within the renderer process.\nPrerequisite to this exploit is the compromise of the renderer process. Once the renderer is compromised, the attacker can execute arbitrary code within the context of that process.\nBy triggering the vulnerability, the attacker manipulates the renderer's interactions with the network stack, forcing it to disclose sensitive information that the renderer process should not have authorized access to, or that should be shielded from the renderer by the browser's security policy.\nThis information leakage occurs because the renderer process can influence the network stack into returning data that it would otherwise be denied. The crafted HTML page utilizes specific API calls or sequences of events that exploit edge cases in how network requests are formulated, processed, or returned to the renderer.\nBecause the renderer is already compromised, the attacker can use this information disclosure to bypass Same-Origin Policy (SOP) restrictions, potentially exfiltrating data from other origins or accessing internal browser configuration data.\nThe root cause is likely an improper validation of data returned from the browser's network service to the renderer, or a failure in enforcing security constraints on network responses within the renderer's network-related IPC (Inter-Process Communication) handlers.\nThis vulnerability does not require authentication from the victim, but it relies on the prerequisite renderer compromise. It is remotely exploitable through the network, provided the attacker can convince the victim to navigate to the malicious content.\nPost-exploitation impact includes the potential for session hijacking, credential theft, or the discovery of internal network topology information, significantly increasing the attacker's capabilities for further compromise or lateral movement."
}