CVE-2026-121088 in Chrome
Summary
by MITRE • 11/03/2026
Missing authorization in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified as missing authorization within the Performance APIs of Google Chrome, specifically in versions prior to 157.0.8103.38, represents a significant breach in browser-level access control mechanisms. This flaw stems from an insufficient validation of origin permissions when executing performance-related functions that interact with cross-origin resources. In modern web architectures, the Same-Origin Policy serves as a critical security boundary designed to prevent malicious scripts on one site from accessing data belonging to another site. However, this specific implementation error allows a remote attacker to bypass these restrictions by crafting an HTML page that leverages the Performance API to extract sensitive timing or resource load information from cross-origin domains without proper authorization checks.
From a technical perspective, the core issue lies in how the browser handles requests for performance metrics across different origins. Typically, APIs such as getEntriesByType or those within the Navigation Timing specification are expected to filter out data originating from unauthorized sources to maintain isolation between web contexts. In this instance, the code path responsible for retrieving these metrics failed to adequately verify whether the requesting script possessed the necessary permissions relative to the target resource's origin. Consequently, a malicious webpage hosted on an attacker-controlled domain could invoke these API methods and receive detailed performance data about resources loaded by a victim’s browser from a different, protected domain. This capability effectively neutralizes the intended security boundary provided by cross-origin isolation policies.
The operational impact of this vulnerability is primarily centered around information disclosure and potential facilitation of further attacks. By obtaining cross-origin timing data, an attacker can perform sophisticated side-channel analysis to infer user behavior or sensitive content loading patterns that should remain private. For example, precise measurement of resource load times can reveal whether specific files were cached or fetched from the network, potentially exposing the presence of certain applications or documents on a victim’s system. Furthermore, this information leakage can aid in fingerprinting techniques used to identify unique users across sessions and domains, thereby compromising user privacy and anonymity. While the Chromium security severity is classified as Medium, indicating that exploitation requires specific conditions such as social engineering or targeted delivery via crafted HTML pages, the potential for long-term surveillance and data correlation remains a serious concern for enterprise environments relying on strict browser isolation policies.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in authorization checks that allow unauthorized access to resources. Additionally, it relates to ATT&CK technique T1071, Application Layer Protocol, as the exploitation occurs through standard web protocols and APIs rather than network-level exploits. The attack vector is classified under Remote Code Execution principles but more accurately fits within Information Exfiltration scenarios where data is stolen via legitimate application interfaces due to misconfiguration or logic errors in access control lists.
To mitigate this risk, organizations must ensure that all instances of Google Chrome are updated to version 157.0.8103.38 or later, which contains the necessary patches for these authorization checks within the Performance API implementation. Administrators should enforce automated update policies to minimize the window of exposure during which vulnerable versions remain in use. For users unable to immediately upgrade, implementing strict Content Security Policy directives can help restrict the execution of scripts from untrusted origins and limit the ability of external pages to interact with performance metrics. Additionally, deploying browser isolation solutions or sandboxing technologies can provide an additional layer of defense by preventing cross-origin data leakage even if a vulnerability is successfully exploited within the main browsing context. Regular security audits focusing on API usage patterns in custom web applications are also recommended to identify similar logic flaws before they can be leveraged by adversaries.