CVE-2026-121108 in Chrome
Summary
by MITRE • 11/03/2026
Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as a confused deputy flaw within the Background Fetch API of Google Chrome prior to version 157.0.8103.38 represents a significant deviation from expected web origin policy enforcement mechanisms. This class of vulnerability occurs when an application, acting on behalf of a user or another program, inadvertently performs actions that exceed its intended privileges due to insufficient validation of the requestor's identity or context. In this specific instance, the Background Fetch API, which allows websites to perform long-running downloads in the background even after the initiating page has been closed, failed to correctly isolate execution contexts between different origins. This architectural oversight enabled a remote attacker to exploit the trust relationship established by the browser engine, allowing malicious code hosted on one origin to manipulate or access resources associated with another trusted origin without proper authorization checks.
From a technical perspective, the core flaw lies in how the Background Fetch service handles requests initiated from sandboxed iframes or cross-origin contexts. When a webpage initiates a background fetch operation, it typically does so under its own security context. However, due to the confused deputy condition, the browser's internal handlers did not sufficiently verify that the subsequent operations performed by the background task were strictly bound to the original initiator's origin policy constraints. This allowed crafted HTML pages to construct requests that appeared legitimate within the Background Fetch framework but effectively bypassed same-origin restrictions. The attacker could leverage this misconfiguration to read sensitive data from other origins or trigger actions on behalf of users who had previously interacted with a trusted site, thereby undermining the fundamental isolation guarantees provided by modern web browsers.
The operational impact of this vulnerability is substantial for end-users and enterprise environments relying on Chrome for secure browsing. By bypassing web origin policies, an attacker could potentially exfiltrate sensitive information such as session cookies, personal data, or proprietary content from websites that users trust but do not actively interact with at the moment of exploitation. This capability facilitates sophisticated phishing campaigns where malicious sites can silently harvest credentials or financial details by piggybacking on legitimate background processes. Furthermore, it opens avenues for cross-site request forgery attacks and unauthorized API calls, compromising the integrity and confidentiality of web applications that depend on strict origin isolation to prevent data leakage between unrelated domains.
To mitigate this risk, organizations must ensure that all instances of Google Chrome are updated to version 157.0.8103.38 or later, where these security patches have been applied by the Chromium team. This update addresses the underlying logic errors in the Background Fetch implementation, ensuring that origin checks are rigorously enforced during both initiation and execution phases of background tasks. Additionally, developers should review their use of the Background Fetch API to ensure it is only employed when necessary for critical functionality, as reducing the attack surface minimizes exposure to such vulnerabilities. Security teams should also monitor browser update cycles closely and implement automated patch management solutions to deploy these fixes promptly across all endpoints.
This vulnerability aligns with CWE-274, which describes improper enforcement of a permission or access control check during an action that is performed on behalf of another entity. It also maps to the MITRE ATT&CK framework under techniques related to privilege escalation and defense evasion, specifically how attackers leverage trusted processes to bypass security boundaries. Understanding these mappings helps in categorizing similar future incidents within established threat intelligence models, facilitating more effective detection rules and incident response procedures for security operations centers managing Chrome-based environments.