Description

Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:18:11.490Z",
  "pubdate": "2026-08-25T21:18:11.490Z",
  "executiveSummary": "A security vulnerability categorized as incorrect authorization exists within the Document Object Model (DOM) implementation of Google Chrome. This flaw allows a remote, unauthenticated attacker to bypass established security policies to facilitate the unauthorized disclosure of sensitive information.\nThe vulnerability affects Google Chrome versions prior to 152.0.7977.65. By leveraging a specially crafted HTML page, an attacker can influence the browser's internal logic, resulting in information leakage.\nThe risk implication is rated as Low by Chromium security. However, such flaws can be utilized as a primitive within a larger, chained exploit sequence to bypass Same-Origin Policy (SOP) protections or exfiltrate sensitive data cached or processed within the browser's DOM context.\nExploitation requires minimal interaction, generally necessitating that a victim navigates to a malicious URL or interacts with a compromised web page under the attacker's control.",
  "technicalDetails": "The root cause of this vulnerability lies in an authorization logic failure during the processing of specific DOM-related operations within the Chromium rendering engine. In the context of browser security, the DOM acts as the interface through which scripts manipulate the content, structure, and style of a document. Security boundaries rely on the strict enforcement of access control checks whenever sensitive interfaces or properties are accessed via scripted elements.\nSpecifically, the flaw exists within the component responsible for mediating authorization checks for DOM nodes or their associated objects. An improper implementation of these checks allows a crafted HTML document to bypass intended security constraints. When the browser engine fails to correctly validate the requester's authority against the target DOM element, it allows unauthorized cross-origin access or access to restricted internal properties that should otherwise be shielded from external scripts.\nThe exploitation flow typically involves the following steps: 1) The attacker constructs a malicious HTML page containing JavaScript designed to trigger the specific vulnerable DOM API call. 2) Upon loading the page in the victim's browser, the malicious script invokes an operation that bypasses the deficient authorization check. 3) The browser's rendering engine incorrectly honors this request due to the insufficient authorization logic. 4) The script successfully interacts with restricted or protected DOM objects, extracting sensitive data—such as session information, document metadata, or cached user inputs—which is then transmitted to an attacker-controlled server.\nThis vulnerability does not require authentication or elevated privileges on the victim's machine, as the browser processes the malicious HTML context using the user's current session permissions. The network exposure is broad, as any user browsing the web is potentially susceptible if they visit an attacker-controlled site or a site hosting malicious advertisements. The post-exploitation impact is focused primarily on information disclosure, though it effectively weakens the compartmentalization of sensitive data stored in the browser's runtime environment, which can facilitate further attacks against the integrity and confidentiality of the user's browsing session."
}