CVE-2026-84331 in Chrome
Summary
by MITRE • 09/02/2026
Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as an incorrect authorization issue within the Actor component of Google Chrome prior to version 152.0.7977.75 represents a significant breach in browser isolation mechanisms, specifically targeting the web origin policy enforcement logic. This flaw allows for privilege escalation from a compromised renderer process to access resources that should be strictly isolated by same-origin policies. In modern web browsers like Chrome, the architecture is designed with multiple processes where each tab or frame typically runs in its own sandboxed renderer process. The primary security goal of this multi-process architecture is to ensure that code running within one origin cannot read or modify data from another origin without explicit permission. However, when an attacker successfully compromises a renderer process through other means such as exploiting a separate vulnerability like a use-after-free or buffer overflow in JavaScript engine components, they gain the ability to execute arbitrary code within that sandboxed environment. The flaw in the Actor component undermines this isolation by failing to correctly validate authorization checks before allowing actions that cross origin boundaries.
From a technical perspective, the defect lies in how the browser handles inter-process communication and permission grants when an actor attempts to perform operations on behalf of a web page. An attacker crafting a malicious HTML page can leverage specific API calls or internal browser mechanisms to trick the renderer into performing actions outside its designated security context. This bypasses the same-origin policy, which is fundamental to preventing cross-site scripting attacks and data theft across different websites. The severity is classified as low by Chromium standards because it requires an initial compromise of a renderer process, meaning it cannot be exploited directly via a simple URL visit without first exploiting another vulnerability or having existing access through phishing or drive-by downloads that lead to code execution within the sandbox. Nevertheless, this capability significantly lowers the barrier for attackers who have already achieved partial system control, enabling them to escalate their privileges and potentially steal sensitive data such as cookies, local storage contents, or session tokens from other tabs or origins open in the same browser instance.
The operational impact of this vulnerability is substantial despite its low severity rating because it facilitates lateral movement within a user's browsing context. Once an attacker bypasses web origin policies, they can access cross-origin resources that were previously protected by sandboxing. This includes reading sensitive information stored locally on the client side or interacting with APIs from other domains without proper authentication headers being stripped or validated correctly. For enterprise environments relying on Chrome for secure browsing, this means that a single compromised tab could serve as a pivot point to exfiltrate data from more critical internal applications accessed in different tabs. The risk is amplified if users frequently log into multiple accounts across various services within the same browser profile, as the attacker can harvest credentials or session tokens from these unrelated sites without triggering typical security alerts associated with direct cross-site scripting attacks.
Mitigation strategies primarily involve updating to a patched version of Google Chrome where this authorization logic has been corrected to enforce stricter checks on actor permissions and origin boundaries. Administrators should ensure that automatic updates are enabled so that users receive the fix for version 152.0.7977.75 or later as soon as it becomes available. In environments where immediate patching is not feasible, implementing strict Content Security Policy headers can help mitigate some downstream effects by restricting how scripts interact with external resources and validating origins more rigorously at the application level rather than relying solely on browser-level isolation. Additionally, deploying endpoint detection and response solutions that monitor for unusual process behavior or unauthorized inter-process communications within the Chrome sandbox can provide an additional layer of defense against exploitation attempts targeting this specific flaw.
This vulnerability aligns with CWE-269 which describes Improper Authorization, where a user is able to access resources or perform actions they are not entitled to do due to flawed permission checks. It also relates to ATT&CK technique T1055.012 Process Injection and potentially T1048 Exfiltration Over Alternative Protocol depending on how the attacker utilizes the bypassed permissions to steal data. Understanding these mappings helps security teams prioritize remediation efforts based on broader threat intelligence frameworks rather than just individual CVE identifiers, ensuring that similar architectural weaknesses in browser isolation are addressed comprehensively across all deployed endpoints.