CVE-2026-95278 in Chrome
Summary
by MITRE • 09/29/2026
Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as missing authorization within the WakeLock API of Google Chrome prior to version 154.0.8037.57 represents a significant breach in process isolation and privilege management mechanisms. This flaw specifically affects the interaction between web content and system-level power management features, allowing for unauthorized access to hardware resources that should be strictly controlled by the operating system or browser security policies. The WakeLock API is designed to prevent devices from entering sleep mode when specific applications require continuous operation, such as during media playback or navigation. However, due to insufficient authorization checks within this component, the boundary between untrusted web content and privileged system functions was effectively blurred, creating an avenue for exploitation by attackers who have already achieved a foothold within the browser environment.
The technical nature of this flaw centers on the failure to enforce proper access control when requesting wake locks from renderer processes. In modern browsers like Chrome, different tabs or origins are typically sandboxed into separate renderer processes to limit the impact of potential exploits. When an attacker compromises a renderer process through other means, such as exploiting a memory corruption vulnerability in JavaScript engine code, they gain limited execution privileges within that isolated context. Normally, requests for sensitive system APIs should be routed through higher-privilege browser processes with strict validation. In this case, however, the WakeLock implementation failed to verify whether the requesting renderer process had legitimate authorization or if it was acting on behalf of a trusted origin. This oversight allowed a crafted HTML page hosted by an attacker to successfully request and acquire wake locks without proper permission verification, effectively bypassing system access restrictions intended to protect device resources and user privacy.
The operational impact of this vulnerability is primarily tied to the potential for denial-of-service attacks and increased battery consumption on affected devices. By forcing the operating system to keep the display or CPU active through unauthorized wake lock requests, an attacker can drain a mobile device's battery rapidly or prevent it from entering low-power states even when idle. While classified as having a Low security severity by Chromium standards due to the prerequisite of renderer process compromise, this vulnerability serves as a critical escalation path in attack chains. It transforms a contained sandbox escape into persistent system-level interference, potentially disrupting user experience and device functionality without requiring physical access or administrative privileges on the host machine.
From a classification perspective, this issue aligns with CWE-269, which denotes Improper Privilege Management, as it involves granting capabilities to an entity that should not possess them based on its current trust level. Furthermore, within the MITRE ATT&CK framework, this behavior is consistent with techniques related to Resource Hijacking and potentially Defense Evasion through persistence mechanisms if combined with other exploits. The lack of strict authorization checks in system APIs exposed by web browsers highlights a recurring challenge in balancing functionality against security isolation boundaries.
Mitigation for this vulnerability requires immediate updates to Google Chrome on all affected platforms, as the fix was included in version 154.0.8037.57 and subsequent releases. Users should ensure that automatic browser updates are enabled to receive patches promptly. For enterprise environments, administrators must verify that endpoint protection solutions can detect abnormal wake lock activity patterns indicative of such abuse. Additionally, developers integrating web technologies into applications should adhere strictly to the latest Web APIs specifications which enforce stricter origin checks and permission models for power management features. Regular security audits focusing on browser API usage within web content can help identify similar authorization gaps before they are exploited in the wild.