CVE-2026-102320 in Chrome
Summary
by MITRE • 09/29/2026
Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as missing authorization in Cross-Origin Resource Sharing within Google Chrome prior to version 154.0.8037.92 represents a critical failure in the browser's enforcement of same-origin policies through improper handling of CORS preflight requests or response headers. This flaw allows a remote attacker, who has already achieved code execution within a renderer process due to another vulnerability, to bypass web origin restrictions and access sensitive data from other origins that should be inaccessible under normal circumstances. The Chromium security team classified this issue with a medium severity rating, indicating that while the exploitation requires an initial foothold in the renderer, the resulting impact on confidentiality is significant because it undermines one of the primary defenses against cross-site scripting and data exfiltration attacks.
From a technical perspective, Cross-Origin Resource Sharing relies heavily on strict validation of origin headers during both preflight OPTIONS requests and actual resource fetches to ensure that only authorized domains can interact with resources hosted on different origins. In this specific instance, the browser failed to properly verify authorization credentials or token validity when processing CORS-related operations initiated by a compromised renderer process. This oversight effectively neutralizes the protective barrier intended to isolate web content from different sources, allowing malicious scripts running in one tab or frame to read responses from another origin without triggering standard security warnings or blocking mechanisms. The attacker leverages this misconfiguration to construct crafted HTML pages that exploit the lack of proper authorization checks, thereby facilitating unauthorized data retrieval across domain boundaries.
The operational impact of this vulnerability is substantial for users relying on Chrome for secure web browsing and application development. By bypassing origin policies, an attacker can exfiltrate sensitive information such as session tokens, personal identifiable information, or proprietary business logic stored in local storage or accessible via AJAX requests to third-party services. This capability significantly lowers the barrier for data theft attacks because it does not require complex social engineering or zero-day exploits beyond the initial renderer compromise. The ability to read cross-origin responses means that even if an attacker is confined to a specific tab, they can still harvest credentials and sensitive payloads from other tabs where users are logged into banking portals, email services, or enterprise applications, leading to potential account takeovers and broader system compromises.
This vulnerability aligns with CWE-942, which describes the Permissive Cross-domain Access with Untrusted Data, as it involves allowing cross-origin requests without adequate validation of trustworthiness. Furthermore, in terms of offensive security frameworks like MITRE ATT&CK, this behavior facilitates techniques associated with Collection and Exfiltration over Alternative Protocols or Web Protocol data staging. The attacker utilizes the browser's own networking stack to move stolen data out of the victim environment, leveraging legitimate web traffic patterns to evade network-based detection systems that might otherwise flag unusual outbound connections.
To mitigate the risks associated with this vulnerability, organizations should prioritize immediate patching by updating Google Chrome to version 154.0.8037.92 or later across all endpoints. For environments where automatic updates are not feasible, manual deployment of the latest stable release is essential to close the gap in CORS authorization checks. Additionally, developers and security teams should review their web applications for any reliance on permissive CORS configurations that might exacerbate similar issues if other vulnerabilities exist. Implementing strict Content Security Policy directives can provide an additional layer of defense by restricting which origins are allowed to execute scripts or fetch resources, thereby reducing the attack surface even in the event of a renderer compromise. Regular security audits and penetration testing focused on cross-origin interactions will help identify and remediate similar architectural weaknesses before they can be exploited.