CVE-2026-78966 in Chrome
Summary
by MITRE • 08/26/2026
Externally controlled reference in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an externally controlled reference issue within the QUIC implementation of Google Chrome prior to version 152.0.7977.65 represents a significant deviation from expected web isolation boundaries. This flaw allows for the bypassing of origin policies, which are fundamental security mechanisms designed to prevent malicious scripts on one page from obtaining access to sensitive data such as cookies or local storage from another site. The root cause lies in how the browser handles network connections established via the QUIC protocol, specifically regarding the validation and assignment of origins to these connections. When a crafted HTML page is loaded by an attacker, it can exploit this misconfiguration to establish a connection that the browser incorrectly associates with a different origin than intended. This failure in strict origin enforcement undermines the Same-Origin Policy, which is critical for maintaining the confidentiality and integrity of web applications.
From a technical perspective, QUIC operates over UDP rather than TCP, providing multiplexed streams and improved performance characteristics compared to traditional HTTP/2 connections. However, this architectural shift introduces new attack surfaces related to connection identification and origin tracking. In this specific instance, the browser failed to correctly map the network socket or stream identifier back to its originating context after certain operations or state changes within the QUIC stack. This discrepancy enables a remote attacker to craft an HTML page that leverages JavaScript APIs to interact with resources belonging to a different domain. By manipulating how the browser interprets the source of incoming data, the attacker can trick the user agent into treating cross-origin requests as same-origin ones, thereby circumventing standard security checks such as Cross-Origin Resource Sharing validations and cookie isolation rules.
The operational impact of this vulnerability is substantial for users browsing untrusted or malicious websites. An adversary who successfully exploits this flaw could potentially steal sensitive information stored in cookies, access local storage data from other domains, or perform actions on behalf of the user against their will through cross-site request forgery mechanisms that rely on automatic credential inclusion. This effectively breaks the isolation between different web origins, allowing for data exfiltration and unauthorized state manipulation. The severity is classified as medium because while it does not allow direct code execution or arbitrary memory corruption, its ability to bypass origin policies facilitates a wide range of secondary attacks including session hijacking and sensitive data theft.
This vulnerability aligns with CWE-20 Improper Input Validation, specifically where the input control over network resources leads to security policy violations. It also maps closely to MITRE ATT&CK technique T1534 Internal Spearphishing or more accurately in this context, techniques related to browser-based attacks such as Client-side Proxying (T1567) if used for interception, but primarily it falls under Web Application Attack Vector categories involving Origin Policy Bypass. The exploitation requires user interaction in the form of visiting a crafted webpage, which limits its scope compared to drive-by downloads but increases its relevance in phishing and social engineering campaigns targeting high-value accounts or sensitive corporate data hosted on web platforms.
Mitigation for this issue primarily involves updating Google Chrome to version 152.0.7977.65 or later, where the QUIC implementation has been patched to correctly enforce origin boundaries regardless of connection state changes. For organizations unable to update immediately due to compatibility constraints, implementing strict Content Security Policy headers can help mitigate some downstream effects by restricting which origins are allowed to load resources and execute scripts. Additionally, disabling third-party cookies in browser settings reduces the impact of any potential session hijacking resulting from this flaw. Users should remain vigilant against visiting untrusted links or pages that attempt to interact with sensitive web applications, as no client-side mitigation can fully replace the need for patched software when origin isolation is compromised at the protocol handling layer.