Description

Improper input validation in Network in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:18:19.777Z",
  "pubdate": "2026-08-25T21:18:19.777Z",
  "executiveSummary": "A vulnerability categorized as improper input validation exists within the Network component of Google Chrome on the Windows platform.\nThis security flaw allows a remote attacker to perform unauthorized sensitive information disclosure.\nExploitation requires the attacker to employ social engineering techniques to entice a user into interacting with a specifically crafted HTML page.\nThe vulnerability is rated as Low severity by the Chromium project, reflecting the reliance on external user interaction and the specific constraints required to trigger the leak.\nIf successfully exploited, the attacker may gain access to sensitive information, potentially leading to a breach of user privacy or session security.\nThis issue affects versions of Google Chrome on Windows prior to 152.0.7977.65.",
  "technicalDetails": "The root cause of this vulnerability lies in insufficient input validation logic within the Network stack of Google Chrome's codebase on the Windows operating system.\nThe vulnerability manifests when the browser processes maliciously crafted network-related inputs provided via an HTML page, which fail to adhere to expected sanitization or boundary checks.\nExploitation follows a specific attack flow: First, an attacker hosts a weaponized HTML document on a remote server. Second, the attacker utilizes social engineering tactics to persuade a victim to navigate to this page within the Chrome browser. Third, once the page is rendered, the crafted content triggers the flawed input validation path in the browser's Network component.\nBy manipulating the inputs processed by the browser's networking logic, the attacker can force the application to disclose sensitive information that would otherwise be protected by browser security boundaries, such as the Same-Origin Policy (SOP).\nBecause the vulnerability resides in the interaction between HTML content and the browser's internal network handling, it does not require prior authentication or elevated privileges from the attacker; the primary constraint is the success of the social engineering campaign.\nThe vulnerability occurs within the Chrome Network layer, which manages resource fetching and protocol handling. The improper validation allows for unexpected cross-protocol or cross-origin side-channel behavior, leading to data exfiltration.\nThe scope of the impact is constrained by the browser's sandbox environment, but the information leak could potentially expose tokens, credentials, or sensitive headers processed during the victim's network transactions.\nThis vulnerability is present in versions of Google Chrome on Windows prior to 152.0.7977.65, indicating that updates are necessary to rectify the validation errors and restore secure processing of network-bound data."
}