CVE-2026-121161 in Chrome
Summary
by MITRE • 11/03/2026
Information leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as an information leak within the Background Fetch API of Google Chrome, specifically in versions prior to 157.0.8103.38, represents a significant breach of web isolation principles. The Background Fetch API is designed to allow websites to initiate long-running downloads that continue even if the user navigates away from or closes the page hosting the script. This functionality is critical for applications requiring reliable data synchronization in poor network conditions. However, the flaw exploited here stems from an improper handling of cross-origin requests during this background process. When a malicious actor crafts an HTML page designed to trigger Background Fetch operations targeting resources on different origins, the browser fails to correctly enforce same-origin policy restrictions within the context of these asynchronous downloads. This oversight allows the attacker's script to access data that should have been strictly isolated from their origin, effectively bypassing standard security boundaries intended to prevent cross-site information leakage.
From a technical perspective, this flaw aligns with CWE-200, which classifies it as an Information Exposure vulnerability where sensitive information is disclosed to unauthorized actors. The root cause lies in the implementation of the Background Fetch service worker logic, which did not adequately sanitize or restrict access to response bodies originating from cross-origin sources when processed by the initiating script. In a secure environment, any data fetched via this API should be opaque to scripts that do not share the same origin as the target resource. The failure to enforce this separation means that sensitive headers, cookies, or body content intended for other domains can be read by the malicious page. This type of vulnerability is particularly dangerous because it leverages legitimate browser features for data exfiltration, making detection through traditional security monitoring tools more difficult compared to direct injection attacks.
The operational impact of this vulnerability allows a remote attacker to conduct sophisticated cross-origin data theft campaigns without requiring user interaction beyond visiting a compromised or maliciously crafted webpage. By embedding the exploit in an HTML page hosted on a server controlled by the attacker, they can silently retrieve sensitive information from other websites where users might be authenticated and active. This could include personal identifiable information, financial details, or proprietary business data depending on which sites are targeted. The severity is rated as Medium because while it does not allow for arbitrary code execution or full system compromise, the ability to exfiltrate cross-origin data undermines the fundamental trust model of the web platform. Attackers can aggregate this stolen data over time to build detailed profiles of victims or facilitate further social engineering attacks based on the retrieved information.
This incident is closely related to ATT&CK technique T1059.007, which covers JavaScript-based execution, and specifically relates to data exfiltration techniques that leverage browser APIs for covert communication. The vulnerability highlights the ongoing challenges in maintaining strict isolation between different web origins as browsers introduce more powerful features like Background Fetch to improve user experience and application reliability. To mitigate this risk, it is imperative to update Google Chrome immediately to version 157.0.8103.38 or later, where these cross-origin checks have been reinforced. For organizations deploying managed browser environments, enforcing automatic updates through group policies ensures that all endpoints are protected against such exploitation vectors. Additionally, developers should review their use of the Background Fetch API to ensure they are not inadvertently relying on behaviors that could be exploited if older versions remain in circulation within specific user segments. Implementing strict Content Security Policy directives can also help limit the scope of potential data exposure by restricting which origins scripts are allowed to interact with, thereby adding a layer of defense-in-depth against similar information leakage attempts.