Description

Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-09-02T00:18:27.980Z",
  "pubdate": "2026-09-02T00:18:27.980Z",
  "executiveSummary": "A vulnerability classified as incorrect authorization exists within the Actor component of Google Chrome, affecting versions prior to 152.0.7977.75.\nThe flaw permits a remote attacker who has already successfully compromised the renderer process to circumvent the Same-Origin Policy (SOP).\nBy leveraging a specially crafted HTML page, an adversary can perform unauthorized cross-origin operations that are normally restricted by the browser's security architecture.\nThis vulnerability is rated as Low severity by the Chromium security team, primarily because it requires a prerequisite compromise of the renderer process.\nThe impact involves potential data exfiltration or unauthorized interaction with other origins, undermining the browser's fundamental isolation guarantees.\nThe attack is essentially a sandbox escape mechanism at the process level that grants the attacker elevated influence over the rendering engine's origin-based access control policies.",
  "technicalDetails": "The vulnerability originates from an incorrect authorization check within the Actor implementation, which is responsible for managing inter-process communication and state synchronization between the renderer process and the browser process in Chromium.\nThe root cause lies in the insufficient validation of authorization tokens or state requests when the renderer communicates with the browser-side Actor instance. Because the browser process trusts the incoming requests from the renderer regarding origin-bound operations, the lack of strict validation allows a compromised renderer to spoof or manipulate origin identifiers.\nThe attack flow requires the attacker to first gain control of the renderer process, typically through a separate memory corruption vulnerability such as a use-after-free or buffer overflow. Once the renderer process is compromised, the attacker can execute arbitrary code within that isolated sandbox.\nExploitation involves the attacker injecting a crafted HTML page into the renderer's DOM. This page initiates requests to the browser process that interact with the Actor component. By manipulating the parameters sent to the Actor, the attacker forces the browser to treat the malicious renderer's requests as originating from a privileged or different origin.\nBy bypassing the Web Origin Policy, the attacker effectively breaks the Same-Origin Policy (SOP) enforcement. This allows the compromised renderer to access sensitive data, such as cookies, local storage, or authenticated session information belonging to other origins that the user may be interacting with in separate tabs or frames.\nThe vulnerability resides within the internal communication protocols of the Chromium architecture. It is classified as an authorization flaw rather than a memory safety issue, indicating that the logic responsible for gating access to protected origin data fails to correctly verify the authenticity of the requester's context. Post-exploitation, the attacker maintains the ability to bypass security boundaries, potentially leading to cross-site scripting (XSS) in unauthorized contexts or the unauthorized retrieval of sensitive information from cross-origin resources. Since the renderer is the primary engine for parsing and executing web content, once the origin policy is subverted, the attacker can interact with any resource that the user's browser session can access."
}