CVE-2026-78946 in Chrome
Summary
by MITRE • 08/26/2026
Incorrect authorization in Select in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an incorrect authorization flaw within the select element processing of Google Chrome versions prior to 152.0.7977.65 represents a significant deviation from expected browser security boundaries. This issue stems from a logic error in how the user agent handles permission checks when interacting with form elements, specifically those involving selection lists or dropdown menus embedded within web pages. The core technical flaw lies in the failure to strictly enforce origin-based access controls during specific rendering or interaction states of these UI components. When a malicious actor constructs an HTML page designed to exploit this gap, they can manipulate the browser's internal state machine to perform actions that should be restricted by the same-origin policy. This bypass allows scripts running from one origin to inadvertently gain elevated privileges or access data associated with another origin through the compromised select element handling mechanism.
From a technical perspective, web origins are fundamental to modern internet security, ensuring that content loaded from different sources cannot interfere with each other unless explicitly permitted via mechanisms like Cross-Origin Resource Sharing. The flaw in Chrome’s implementation suggests that under certain conditions, such as specific timing sequences or particular DOM structures involving select elements, the browser fails to validate whether the current script context has the requisite authorization to interact with resources outside its designated origin. This is not a memory corruption issue but rather an access control bypass where the security model's enforcement layer is circumvented due to incomplete state validation. The Chromium project classified this vulnerability as having low severity because while it allows for policy violation, the practical exploitation requires precise crafting of HTML and likely depends on specific user interactions or browser states that are not trivially achievable in all contexts.
The operational impact of this vulnerability centers on the potential compromise of data confidentiality and integrity through cross-origin information leakage or unauthorized state manipulation. An attacker could potentially use a crafted webpage to read sensitive form data, trigger actions on behalf of the user without proper consent indicators, or manipulate session states if such operations are tied to select element interactions. While the low severity rating indicates that widespread exploitation is unlikely due to the complexity required for successful attack vectors, it still poses a risk in scenarios where users interact with untrusted content containing sophisticated social engineering elements combined with this technical exploit. The ability to bypass web origin policies undermines the trust model of the browser environment and could lead to unauthorized data access if other security layers are also weakened or misconfigured.
Mitigation strategies primarily involve updating the Google Chrome installation to version 152.0.7977.65 or later, where these authorization checks have been corrected to ensure strict adherence to origin policies regardless of the specific UI component involved. For organizations managing large fleets of devices, deploying this patch via centralized management tools is essential to close the window of exposure. Additionally, users should exercise caution when visiting unfamiliar websites and consider using browser extensions that enforce stricter content security policies or block potentially malicious scripts from executing arbitrary commands. Monitoring for unusual network requests originating from local HTML files can also help detect attempted exploitation in real-time.
This vulnerability aligns with CWE-269, which describes Improper Authorization, as the system failed to properly verify user privileges before allowing an action that should have been restricted. Furthermore, it relates to ATT&CK technique T1059, Command and Scripting Interpreter, specifically within the context of web-based scripting environments where malicious actors leverage browser capabilities to execute unauthorized operations. Understanding these mappings helps security teams categorize the risk accurately and apply appropriate controls from frameworks like NIST SP 800-53 or ISO 27001 that emphasize access control and secure system design principles. Regular vulnerability assessments and prompt patching remain the most effective defenses against such logic-based flaws in widely used software applications.