CVE-2026-121102 in Chrome
Summary
by MITRE • 11/03/2026
Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified as missing authorization within the Background Fetch API of Google Chrome represents a significant deviation from expected browser security boundaries, specifically targeting the isolation mechanisms that enforce same-origin policies. Prior to version 157.0.8103.38, the implementation failed to adequately validate whether the initiating context possessed the necessary permissions or origin privileges required to execute background fetch operations. This flaw allows a remote attacker to exploit the browser's trust in its own API by crafting an HTML page that triggers a Background Fetch request without proper authorization checks. The core technical issue lies in the failure of the security layer to verify the caller's identity against the resource being requested, effectively creating a gap where cross-origin data or actions can be initiated under false pretenses.
From a technical perspective, this vulnerability falls squarely under CWE-269, which denotes Improper Privilege Management. The Background Fetch API is designed for long-running tasks that continue even after the user has navigated away from the page, making it critical that strict origin checks are enforced to prevent abuse. When these checks are bypassed, an attacker can leverage this misconfiguration to perform actions such as unauthorized data exfiltration or initiating requests on behalf of a victim who is authenticated with a target service. This undermines the fundamental web security model where browsers act as trusted intermediaries ensuring that scripts from one origin cannot interfere with resources belonging to another origin without explicit permission via mechanisms like CORS.
The operational impact of this vulnerability is categorized under ATT&CK technique T1530, Data from Cloud Storage, and potentially T1078, Valid Accounts, depending on the specific exploitation scenario. An attacker could use a crafted webpage hosted on a malicious domain to trigger background fetches that retrieve sensitive data from an API or service where the victim is logged in. Because Background Fetch operations run independently of the main page lifecycle, they can persist and execute even if the user closes the tab, making detection more difficult for standard browser security monitors. This persistence increases the risk of stealthy data theft or unauthorized state changes on vulnerable web applications that rely on session cookies or tokens passed implicitly with these requests.
Mitigation strategies primarily involve updating Google Chrome to version 157.0.8103.38 or later, where this authorization check has been corrected by the Chromium security team. For organizations unable to patch immediately due to compatibility constraints, implementing strict Content Security Policy directives can help mitigate some risks by restricting which origins are allowed to initiate background fetch operations. Additionally, web application developers should ensure that their APIs do not rely solely on browser-side origin checks for sensitive operations and instead implement server-side validation of request integrity and user authorization states. Regular security audits focusing on the implementation of service workers and background APIs can further reduce the attack surface associated with these powerful browser features.