CVE-2026-84355 in Chrome
Summary
by MITRE • 09/02/2026
Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as an incorrect authorization error within Google Chrome prior to version 152.0.7977.75 represents a significant breach in browser-based isolation mechanisms, specifically targeting the navigation subsystem. This flaw allows for the bypass of web origin policies when triggered by a remote attacker who has already achieved code execution or compromise within a renderer process. The core technical issue lies in how Chrome handles state transitions and permission checks during page navigations initiated from compromised contexts. In modern browser architectures like Chromium, each tab runs in an isolated sandboxed environment known as the renderer process to prevent malicious scripts on one site from accessing data belonging to another. However, this vulnerability exploits a gap where certain navigation actions do not strictly enforce origin boundaries under specific conditions, effectively allowing a lower-privilege context to elevate its access or interact with higher-privileged resources across different origins.
From a technical perspective, the flaw stems from insufficient validation of authorization states during the handling of cross-origin requests and navigations. When an attacker compromises a renderer process through other means such as exploiting a separate vulnerability in JavaScript engine logic or DOM manipulation they can craft HTML pages that trigger specific navigation events. These crafted pages exploit the race conditions or logical errors in how Chrome validates whether the current origin is permitted to perform certain actions on target resources. The browser fails to correctly verify if the initiating context has sufficient privileges for the requested operation, leading to a situation where data intended to be isolated remains accessible. This bypass of web origin policy undermines one of the fundamental security pillars of modern web browsers, which relies heavily on the Same-Origin Policy to restrict how documents or scripts loaded from one origin interact with resources from another origin.
The operational impact of this vulnerability is severe for users who visit maliciously crafted websites while running an affected version of Chrome. Although exploitation requires a pre-existing compromise of the renderer process, such compromises are increasingly common due to drive-by downloads and complex exploit chains that target multiple vulnerabilities simultaneously. Once inside the renderer, an attacker can leverage this flaw to access sensitive information from other tabs or windows, including cookies, local storage data, and potentially session tokens associated with high-value accounts like banking portals or email services. This capability effectively neutralizes the sandboxing protection provided by Chrome for those specific interactions, allowing lateral movement within the user's browsing context and facilitating further attacks such as account takeover or credential theft without requiring direct access to the operating system level.
This vulnerability aligns closely with CWE-269, which describes Improper Authorization, where a principal is granted privileges that it should not possess based on its current state or role. Furthermore, in terms of offensive security frameworks like MITRE ATT&CK, this behavior relates to techniques involving browser exploitation and privilege escalation within the application layer. It facilitates lateral movement by allowing an attacker to pivot from one compromised tab to others, expanding their scope of influence across the user's active sessions. The severity is rated as medium because while it does not provide direct kernel-level access or full system compromise on its own, it significantly degrades the security posture by breaking critical isolation boundaries that protect against cross-site scripting and data leakage attacks.
Mitigation strategies primarily involve updating Google Chrome to version 152.0.7977.75 or later where these authorization checks have been hardened and corrected. For organizations managing large fleets of devices, deploying automated patch management solutions ensures timely application of security updates that address such browser-level flaws. Additionally, users should employ additional layers of defense such as strict content security policies implemented by web applications themselves to limit the impact if a renderer is compromised. Security awareness training remains relevant here as well, since many initial compromises leading to renderer access stem from user interactions with phishing links or malicious advertisements. By maintaining up-to-date software and employing layered security controls, organizations can reduce the attack surface available to adversaries attempting to exploit these intricate browser logic flaws.