Description

Information leak in DataTransfer in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:18:19.000Z",
  "pubdate": "2026-08-25T21:18:19.000Z",
  "executiveSummary": "This vulnerability involves an information disclosure flaw within the DataTransfer interface of Google Chrome, specifically affecting versions prior to 152.0.7977.65. The vulnerability allows a remote attacker to bypass intended security boundaries and access sensitive data through the manipulation of a crafted HTML page.\nThe core issue stems from improper handling of information exposure within the DataTransfer API, which is typically used for drag-and-drop or clipboard operations. By leveraging this flaw, an attacker can extract data that should otherwise be restricted from unauthorized access.\nThe risk implication is considered Low; however, it permits an attacker to perform unauthorized data reconnaissance without requiring user interaction beyond navigating to a malicious site. The vulnerability resides on the client side, where the browser fails to correctly enforce data access policies when interacting with the DataTransfer object. Successful exploitation depends on the victim accessing a specially prepared HTML document, which then triggers the leakage of internal information back to the attacker.",
  "technicalDetails": "The vulnerability resides within the DataTransfer component of the Chromium browser engine. The DataTransfer interface is designed to hold data that is being dragged or moved during a drag-and-drop operation or clipboard interaction. The root cause of this vulnerability is an insufficient sanitization or verification process when the browser manages the data payload stored within this interface.\nDuring the exploitation process, an attacker constructs a malicious HTML page containing JavaScript designed to interact with the DataTransfer object in a non-standard or unexpected manner. When a user navigates to this crafted page, the JavaScript triggers a specific sequence of drag-and-drop events or clipboard-related API calls. Because of the flaw in the DataTransfer handling logic, the browser fails to restrict the visibility of sensitive data objects, allowing the attacker's script to read the contents that were supposed to be protected by the Same-Origin Policy (SOP) or other sandbox restrictions.\nThe attack flow proceeds as follows: 1) The attacker hosts a malicious document on a remote server. 2) The victim visits the page via an affected version of Google Chrome (prior to 152.0.7977.65). 3) The attacker’s script initiates a DataTransfer interaction that exploits the boundary vulnerability. 4) The browser, failing to correctly apply access controls, exposes internal system or user-specific data to the attacker-controlled script. 5) The script then transmits the exfiltrated data back to the attacker’s external server.\nThis vulnerability does not require authentication or elevated privileges, as it exploits the client's browser logic directly. The impact is categorized as an information leak, where sensitive artifacts are exposed. Because the vulnerability is situated in the interaction between the rendering engine and the DataTransfer object, it affects the security integrity of the browser's sandbox environment. The lack of proper validation on the data being transferred allows for the circumvention of security models that expect this data to be localized or transient, rather than accessible to arbitrary JavaScript execution contexts."
}