Description

Improper input validation in NTP Footer in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:18:07.433Z",
  "pubdate": "2026-08-25T21:18:07.433Z",
  "executiveSummary": "This vulnerability, classified with a Chromium security severity of Low, represents an improper input validation flaw residing in the New Tab Page (NTP) Footer component of Google Chrome on Windows. The security boundary violation affects Google Chrome installations on Windows prior to version 152.0.7977.65. Specifically, the flaw enables a remote attacker who has already successfully compromised the renderer process to bypass the Same-Origin Policy (SOP). To execute this attack, the adversary must lure a victim to render a crafted HTML page or programmatically force its rendering via the compromised renderer.\nBy leveraging the improper input validation within the NTP Footer, the attacker can manipulate web origin security controls, potentially allowing unauthorized cross-origin data access or execution of actions in the context of other origins. This vulnerability represents a critical post-compromise escalation vector within the browser's process architecture. While the vulnerability is rated Low because it requires a pre-existing renderer compromise as a prerequisite, it highlights a structural weakness in origin isolation mechanisms. Organizations running legacy Chrome deployments on Windows must prioritize upgrading to version 152.0.7977.65 or later to mitigate the risk of origin policy bypasses.",
  "technicalDetails": "The vulnerability exists within the implementation of the New Tab Page (NTP) Footer component in Google Chrome for Windows. The root cause of the security issue is improper input validation of messages or parameters handled by the NTP Footer interface. When Google Chrome renders the NTP, specific privileged APIs or communication channels are exposed to manage UI elements such as the footer. Under normal operating conditions, the browser's security architecture enforces strict origin checks to prevent untrusted web content or compromised renderers from accessing these interfaces or crossing origin boundaries. However, in affected versions of Google Chrome prior to 152.0.7977.65, the NTP Footer lacks sufficient input validation. An attacker who has already succeeded in compromising the sandboxed renderer process can exploit this deficiency.\nIn Chrome's multi-process architecture, the renderer process is responsible for parsing and executing HTML, CSS, and JavaScript. Although sandboxed, a compromised renderer cannot directly bypass the Same-Origin Policy (SOP) without exploiting a logical or validation flaw in the browser process or higher-privileged components. The attack flow is executed as follows: First, the remote attacker establishes control over the renderer process, typically by exploiting a separate memory corruption or logic vulnerability via a malicious or compromised web page. Second, once the renderer process is compromised, the attacker hosts or generates a specifically crafted HTML page designed to interact with the vulnerable NTP Footer component. Third, the compromised renderer sends malformed, unexpected, or unvalidated input to the NTP Footer Inter-Process Communication (IPC) or binding interface.\nFourth, due to the lack of proper input validation in the NTP Footer, the browser process fails to correctly sanitize or verify the source and content of the request. Fifth, this validation failure allows the attacker to bypass the web origin policy, enabling the compromised renderer to execute actions or read data across origin boundaries that should otherwise be restricted. The post-exploitation impact of this vulnerability is significant, as bypassing the Same-Origin Policy allows the attacker to violate the confidentiality and integrity of other web origins, potentially accessing sensitive session cookies, DOM structures, or user data from unrelated websites loaded within the browser session. This represents a significant breakdown of the browser's security boundary, transforming a renderer compromise into a wider cross-origin security breach."
}