Description

Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-09T01:17:11.920Z",
  "pubdate": "2026-09-09T01:17:11.920Z",
  "executiveSummary": "A security vulnerability categorized as incorrect authorization exists within the Google Chrome browser extensions framework. This flaw allows a remote attacker to circumvent established system access restrictions, enabling unauthorized navigation to a privileged browser page.\nThe vulnerability affects Google Chrome versions prior to 153.0.8010.36. Despite being classified as Low severity by the Chromium project, it represents a breach of the browser's security boundary model.\nExploitation requires the victim to interact with a maliciously crafted HTML page, which the attacker can host on a remote server. Successful exploitation grants the attacker the capability to access sensitive or privileged internal browser pages that should be restricted based on the current authorization context.\nThe primary risk involves the potential for an attacker to gain information disclosure or interact with internal browser features that are otherwise protected from web content. Organizations should prioritize updating to the patched version to restore robust access control enforcement.",
  "technicalDetails": "The vulnerability originates from a flawed authorization check within the Chrome Extensions subsystem, specifically in how the browser validates the origin and context of requests targeting internal, privileged pages. The Chrome security architecture is designed to enforce strict separation between untrusted web content and privileged browser-internal pages (e.g., chrome:// URLs, extension background pages).\nIn the vulnerable versions prior to 153.0.8010.36, the extension framework failed to properly verify the security origin when processing specific navigation or resource requests initiated by external HTML content. This failure allows a crafted HTML page—delivered via a remote web server—to trigger an navigation event that bypasses the intended security sandbox restrictions.\nThe attack flow proceeds as follows: First, an attacker hosts a maliciously crafted HTML page designed to exploit the authorization logic flaw. Second, the attacker lures an authenticated user to visit this page using the Chrome browser. Third, the crafted HTML page triggers a specific sequence of requests or navigation commands that are processed by the Chrome extension subsystem. Because the underlying authorization check is faulty, the browser incorrectly validates the request as authorized. Finally, the browser allows the navigation to a privileged page that would normally be prohibited, granting the attacker context or access to the protected resource.\nThe root cause is a failure in the logic that governs the security boundary between the untrusted renderer process (where the malicious HTML resides) and the privileged browser process component responsible for managing extension permissions and internal page access. By manipulating the request metadata in a way that bypasses these checks, an attacker successfully elevates their context. While the Chromium project assigns a low severity rating, this flaw effectively subverts the browser's capability-based security model. Post-exploitation, the attacker is limited to the functionality exposed by the accessed privileged page, but such access could potentially be leveraged for further information gathering or as part of a more complex multi-stage exploit chain targeting user privacy or system state."
}