Description

Missing authorization in Sensor in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-25T21:18:05.667Z",
  "pubdate": "2026-08-25T21:18:05.667Z",
  "executiveSummary": "A vulnerability categorized as missing authorization exists within the Sensor component of Google Chrome.\nThis security flaw enables a remote attacker who has already successfully compromised the renderer process to exfiltrate sensitive information.\nThe vulnerability affects Google Chrome versions prior to 152.0.7977.65.\nThe primary risk implication is unauthorized data access, allowing an attacker to bypass security boundaries intended to restrict sensor data availability.\nExploitation requires the attacker to have achieved code execution within the renderer process, typically through a secondary exploit chain such as a memory corruption vulnerability.\nGiven the nature of the renderer sandbox, this vulnerability represents a significant escalation in an attacker's ability to extract system or user information without explicit user permission.\nThe flaw highlights a critical failure in the authorization logic governing the communication between the compromised renderer and the sensor backend.",
  "technicalDetails": "The vulnerability originates from insufficient authorization checks within the Sensor implementation in Google Chrome. In the Chromium architecture, the renderer process is sandboxed and operates with restricted privileges to prevent unauthorized access to sensitive hardware or system resources. However, this security model relies on the browser process (the 'broker') to validate requests originating from the renderer.\nIn this specific instance, the Sensor component fails to properly verify the context or authorization status of the calling process before granting access to sensitive sensor data. Because the renderer process serves as the execution environment for web content, an attacker who leverages a separate exploit to execute arbitrary code within this process can interact directly with the Sensor interface. Under normal conditions, the security policy should deny such requests or require explicit user consent via a permission prompt.\nThe attack flow begins with the attacker compromising the renderer process, often through a malicious HTML page containing a secondary exploit, such as a heap overflow or use-after-free vulnerability, which facilitates arbitrary code execution. Once inside the renderer, the attacker crafts a payload designed to interface with the Sensor component's IPC (Inter-Process Communication) mechanisms. Because the authorization logic is missing or improperly implemented, the backend process interprets the renderer's request as legitimate and returns the requested sensor data to the attacker's controlled memory space.\nThe post-exploitation impact involves the unauthorized collection of sensor-based data. Depending on the specific sensor accessible via this flaw, this may include gyroscope, accelerometer, ambient light, or orientation data, which can be leveraged to infer user behavior, perform keystroke side-channel analysis, or fingerprint the device. By bypassing the intended authorization checks, the attacker effectively circumvents the sandbox restrictions, transitioning from a restricted code execution state to active information gathering. The vulnerability remains present in all Google Chrome versions prior to 152.0.7977.65, making immediate patching essential to restore the integrity of the browser's security boundary."
}