Description

Information leak in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-25T21:18:16.080Z",
  "pubdate": "2026-08-25T21:18:16.080Z",
  "executiveSummary": "This vulnerability is an information disclosure flaw identified in the Network component of Google Chrome, affecting versions prior to 152.0.7977.65.\nThe issue manifests as an information leak, categorized under the Chromium security framework with a Medium severity rating.\nThe vulnerability requires an attacker to first compromise the renderer process, typically through a secondary exploit chain such as a remote code execution (RCE) primitive.\nOnce the renderer process is compromised, a remote attacker can leverage a maliciously crafted HTML page to bypass sandbox restrictions and exfiltrate sensitive data from the network layer.\nThe risk implication is significant for users in high-threat environments, as it allows for the extraction of potentially sensitive data handled by the browser's networking stack, which may include internal network information, authentication tokens, or session-related metadata.\nNo user interaction beyond navigating to the malicious page is required once the initial renderer compromise is achieved.\nThe primary defense is ensuring the browser environment is updated to version 152.0.7977.65 or later to mitigate the underlying defect in the networking sub-module.",
  "technicalDetails": "The vulnerability stems from an insecure implementation within the Google Chrome network stack, specifically concerning the handling of inter-process communication (IPC) between the renderer process and the browser process. In Chromium architecture, the renderer process is designed to be sandboxed, with strictly limited access to sensitive system resources and network data.\nThe root cause involves a logic flaw in how the renderer-side requests are processed by the network service when executing specific HTML-based operations. By leveraging a crafted HTML page, an attacker who has already achieved arbitrary code execution within the context of the renderer process can manipulate network-related API calls or IPC messages.\nThe attack flow proceeds as follows: First, the attacker exploits a separate vulnerability to gain control over the renderer process. Second, the attacker renders a specifically engineered HTML document that invokes a sequence of network requests or API interactions that trigger the flaw. The vulnerable component, failing to properly validate the context or scope of the request, inadvertently exposes information that should have remained restricted to the browser process or protected by the site isolation policy.\nBecause the renderer process operates with a restricted set of privileges, the information leak typically pertains to data that the browser's network stack is currently managing, such as headers, cookies, or internal network state information that the renderer would not normally be authorized to access directly. This breach of the security boundary allows for the unauthorized extraction of data that could be used to facilitate further attacks, such as cross-site request forgery (CSRF) or the harvesting of authentication artifacts.\nThis vulnerability highlights a bypass of the browser's security boundary, specifically targeting the separation between the renderer and the network service. Since the network service is responsible for managing outgoing requests, cookies, and authentication state, any logic error that allows a compromised renderer to leak state information from this service effectively undermines the browser's site isolation and cross-origin protection mechanisms. The exploit is remote in nature, as it is delivered via web content, and it requires the attacker to have successfully established a foothold in the rendering engine prior to initiating the exfiltration sequence."
}