Description

Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-09-02T00:18:29.417Z",
  "pubdate": "2026-09-02T00:18:29.417Z",
  "executiveSummary": "This vulnerability involves an incorrect authorization flaw within the navigation component of Google Chrome, identified in versions prior to 152.0.7977.75. The flaw permits a remote attacker who has successfully compromised the browser's renderer process to circumvent the browser's fundamental web origin policy.\nThe vulnerability is classified as having Medium severity within the Chromium security framework. By bypassing origin policy protections, an attacker can perform unauthorized cross-origin actions, potentially leading to unauthorized data access or sensitive interaction with other origins, despite the renderer process being traditionally sandboxed.\nThe primary risk involves the violation of the Same-Origin Policy (SOP), which is the cornerstone of web security. Exploitation requires the attacker to first gain control over the renderer process, typically via a secondary exploit, and then utilize a crafted HTML page to trigger the navigation-based authorization flaw. Successful exploitation allows the attacker to operate outside the intended security boundaries of the browser's navigation logic.",
  "technicalDetails": "The root cause of this vulnerability lies in an authorization failure within the navigation management logic of the Chromium renderer process. In Google Chrome, the navigation pipeline is responsible for handling transitions between different URLs and ensuring that these transitions adhere to security constraints, most notably the Same-Origin Policy (SOP).\nThe vulnerability is specifically located within the navigation handling subsystem. When a renderer process is compromised, an attacker can theoretically gain the ability to manipulate IPC (Inter-Process Communication) messages sent to the browser process. In this instance, the flaw exists where the navigation logic improperly validates the authorization state of the request initiated by the renderer, failing to enforce strict origin-check boundaries during the transition phase.\nThe attack flow commences with the attacker executing arbitrary code within the renderer process, often through a separate vulnerability such as a memory corruption bug in the JavaScript engine or the DOM parser. Once control over the renderer process is established, the attacker crafts a malicious HTML document designed to initiate a navigation request that appears legitimate to the browser's navigation coordinator but violates standard origin security policies.\nBy manipulating the parameters of the navigation call, the attacker exploits the flawed authorization logic, causing the browser to misinterpret the origin context of the requested resource. Because the navigation component fails to perform a rigorous re-verification of the authorization token or origin context after the renderer-initiated request, the browser incorrectly allows the navigation to proceed as if it originated from a trusted source, effectively bypassing the SOP enforcement.\nThe consequence of this bypass is significant, as it grants the attacker the ability to navigate to or interact with contexts that should be isolated from the compromised renderer. This effectively breaks the sandbox boundary, as the browser processes the request in an elevated or improperly authorized context, allowing for cross-origin information disclosure or unauthorized interactions with the target origin’s API surfaces. The failure is not in the network layer, but within the browser's internal state management regarding current navigation intent versus authorized security credentials."
}