CVE-2026-120930 in Chrome
Summary
by MITRE • 11/03/2026
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as an incorrect authorization flaw within the Blink rendering engine of Google Chrome, specifically in versions prior to 156.0.8078.47, represents a significant breach in web origin policy enforcement. This issue stems from a logic error or state management failure within the browser's core component responsible for parsing and executing HTML content. The Blink engine is tasked with isolating resources loaded by different websites to prevent malicious scripts on one site from accessing sensitive data belonging to another. When this isolation mechanism fails due to improper authorization checks, it allows cross-origin requests that should have been blocked to proceed successfully. This type of vulnerability undermines the fundamental security model of modern web browsers, which relies heavily on the Same-Origin Policy to maintain user privacy and application integrity.
From a technical perspective, the flaw likely involves a failure in validating whether a script or resource loaded via a crafted HTML page possesses the necessary permissions to access specific APIs or DOM elements belonging to a different origin. An attacker can construct an HTML file that exploits this gap by triggering actions within Blink that bypass standard security boundaries. For instance, the malicious page might attempt to read cookies, local storage, or perform XMLHttpRequests against a target domain without proper authentication headers being stripped or rejected as expected. The severity is classified as High because it enables remote code execution scenarios indirectly through data exfiltration or session hijacking, rather than direct arbitrary code execution on the host system. This distinction highlights that while the browser itself may not be compromised at the operating system level, the user's interaction with web applications can be fully subverted.
The operational impact of this vulnerability is severe for users who visit maliciously crafted websites or are subjected to drive-by download attacks where such HTML pages are served automatically. A remote attacker could leverage this flaw to steal sensitive information such as session tokens, personal identifiable information, or financial data stored within the browser's context. Furthermore, it facilitates Cross-Site Request Forgery attacks by allowing scripts from an untrusted origin to perform state-changing actions on behalf of a logged-in user against trusted web applications. This erodes trust in online banking, email services, and corporate intranets that rely on cookie-based authentication without additional CSRF protections. The ability to bypass these policies effectively neutralizes many defensive measures implemented by web developers who assume the browser will enforce origin boundaries correctly.
This vulnerability aligns with Common Weakness Enumeration category CWE-269, which covers Improper Authorization, and specifically relates to issues where access control decisions are not enforced properly during resource loading or API invocation. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques used in reconnaissance and collection phases, such as T1059 Command and Scripting Interpreter if script execution is involved, but more accurately maps to data exfiltration methods like T1048 Exfiltration Over Alternative Protocol or T1530 Data from Local System. The exploitation vector is remote via the network, requiring no user interaction beyond visiting a compromised site, which classifies it under initial access vectors in threat modeling exercises.
Mitigation strategies primarily involve updating Google Chrome to version 156.0.8078.47 or later, where these authorization checks have been corrected and hardened against such bypass techniques. Organizations should enforce automatic update policies for all endpoints running the affected browser versions to ensure timely patching. Additionally, web application developers can implement additional layers of defense independent of browser-specific fixes. These include using Content Security Policy headers to restrict script sources, implementing strict CSRF tokens in form submissions, and utilizing Secure flags on cookies to prevent them from being sent over insecure connections or accessible via client-side scripts where possible. Regular security audits focusing on origin isolation logic within complex web applications can also help identify similar architectural weaknesses before they are exploited by adversaries leveraging known browser vulnerabilities.