Description

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-09-02T00:18:27.657Z",
  "pubdate": "2026-09-02T00:18:27.657Z",
  "executiveSummary": "This vulnerability involves a missing authorization flaw within the FileSystem API of Google Chrome.\nThe issue resides in the browser's implementation of origin-based security boundaries, specifically affecting the FileSystem component.\nA remote attacker who has already achieved a compromise of the renderer process can exploit this vulnerability to circumvent the web origin policy.\nBy bypassing these core security controls, an attacker can perform unauthorized read or write operations across origin boundaries that should be strictly isolated.\nThe vulnerability is classified as Medium severity, posing a significant risk to data integrity and user privacy within the browser environment.\nSuccessful exploitation requires the attacker to have pre-existing control over the renderer process, typically achieved through an initial exploit such as a memory corruption vulnerability within a web page context.\nThis flaw underscores the persistent challenge of enforcing strict site isolation and origin verification in complex browser architectures.",
  "technicalDetails": "The vulnerability stems from improper authorization checks within the FileSystem component of the Chromium browser engine. In a secure architecture, the web origin policy ensures that scripts running in one origin cannot access files or data belonging to another origin, maintaining strict sandboxing between disparate web contexts.\nThe flaw occurs because the FileSystem API fails to adequately validate the origin context when interacting with the underlying filesystem, allowing a compromised renderer process to request access to restricted or cross-origin file paths.\nThe attack flow begins with an initial compromise of the renderer process, likely via a remote code execution exploit on a malicious or compromised website. Once control over the renderer is established, the attacker utilizes the compromised process to interface with the browser's privileged components, specifically targeting the FileSystem API.\nBy injecting a crafted HTML page, the attacker invokes FileSystem API calls that bypass the browser's mandatory origin-based permission checks. Since the renderer process, which has been compromised, is authorized to perform these API calls, the browser fails to verify if the origin of the request matches the targeted data partition.\nThe impact is a breach of the Same-Origin Policy (SOP), effectively allowing the attacker to access data that the browser should have restricted. This allows for unauthorized reading of local data cached or stored by other origins, or potentially the overwriting of data depending on the specific permissions granted to the FileSystem API operations.\nThis vulnerability affects Google Chrome versions prior to 152.0.7977.75. The root cause is categorized as an authorization bypass, where the absence of proper validation at the interface level allows an attacker to manipulate the FileSystem beyond the intended sandbox constraints. Because the renderer process already operates with high privileges relative to the browser engine, this bypass allows for a lateral traversal of the browser's local storage security model, undermining the primary defense mechanism that separates user data between different web domains."
}