Description

Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-02T00:18:28.090Z",
  "pubdate": "2026-09-02T00:18:28.090Z",
  "executiveSummary": "This vulnerability involves an incorrect authorization implementation within the SiteSettings component of Google Chrome, specifically affecting versions prior to 152.0.7977.75.\nThe flaw allows a remote attacker to bypass enforced system access restrictions, potentially enabling unauthorized interactions or settings modification that the browser is intended to prevent.\nThe security impact is classified as Medium, reflecting the risk posed by unauthorized access to browser-level security controls.\nExploitation requires the victim to render a specifically crafted HTML page, effectively leveraging a drive-by attack vector.\nThe vulnerability highlights a breakdown in the permission model and validation logic within the Chromium framework's site settings management.\nSuccessful exploitation facilitates an attacker's ability to circumvent security boundaries established by the browser, potentially leading to unauthorized data exposure or the reconfiguration of security policies.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper authorization check within the SiteSettings component of the Chromium browser architecture. Specifically, the component failed to adequately validate the origin or the permission request context when interacting with internal system settings handlers.\nThe vulnerability manifests when the browser processes a maliciously crafted HTML page. This page contains triggers designed to interact with the SiteSettings interface, exploiting the lack of robust authorization verification during these interactions. Because the browser fails to correctly enforce restrictions on these calls, an attacker can manipulate settings that should be protected from web-content-based manipulation.\nAttack Flow: 1. An attacker hosts a crafted HTML page containing malicious JavaScript or specifically structured markup designed to target SiteSettings interfaces. 2. A victim navigates to this page using an affected version of Google Chrome (prior to 152.0.7977.75). 3. Upon rendering, the malicious content initiates a request to the vulnerable SiteSettings component. 4. Due to the authorization flaw, the component fails to verify the context, incorrectly assuming the request is authorized or originating from a trusted source. 5. The browser processes the request, bypassing established security boundaries. 6. The attacker effectively gains unauthorized access to modify or influence browser security settings.\nThe vulnerable component is identified as the SiteSettings module within the Chromium codebase. This module is responsible for governing various site-level permissions, including storage access, hardware device access (camera, microphone), and other security-sensitive browser features.\nThe exploitation does not require prior authentication by the attacker, nor does it necessitate specific user privileges beyond standard browser interaction. It is fully remote, relying solely on the victim's interaction with the malicious content. The impact of such a bypass can be significant, as it may allow an attacker to facilitate further exploitation by altering security policies or permissions that would otherwise be blocked under normal operational security constraints. This bypass effectively subverts the browser's sandbox logic for SiteSettings management."
}