CVE-2026-95297 in Chrome
Summary
by MITRE • 09/29/2026
Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as missing authorization within the contextual tasks feature of Google Chrome, specifically in versions prior to 154.0.8037.57, represents a significant breach in web origin policy enforcement. This flaw allows remote attackers to circumvent standard security boundaries that are designed to isolate content from different origins. The core issue lies in the improper validation of authorization checks when handling contextual tasks, which are operations initiated by user interactions or specific browser contexts. By exploiting this gap, an attacker can execute actions within a privileged context without possessing the necessary permissions, effectively breaking the isolation model that protects users from cross-origin data theft and unauthorized state manipulation.
From a technical perspective, the defect stems from insufficient access control mechanisms in the Chromium engine's handling of contextual task requests. When a webpage initiates a contextual operation, the browser is expected to verify whether the requesting origin has been granted explicit permission by the user or policy configuration. In this vulnerable version, the authorization check was either skipped or incorrectly evaluated for certain types of tasks. This oversight enables a crafted HTML page hosted on an attacker-controlled server to trigger these privileged operations as if it were originating from a trusted source. The attack vector relies entirely on social engineering or drive-by download tactics where the victim is directed to visit the malicious site, which then executes code that leverages this authorization bypass to interact with browser features beyond its intended scope.
The operational impact of this vulnerability is substantial due to its potential for remote exploitation without user interaction beyond visiting a webpage. An attacker can use this flaw to perform actions such as accessing sensitive data stored in local storage or cookies, manipulating the DOM of other tabs if same-origin policies are weakened by related bugs, or triggering privileged browser APIs that could lead to further system compromise. The severity is classified as medium within the Chromium security framework because while it does not directly allow arbitrary code execution on the host machine, it significantly degrades the confidentiality and integrity guarantees provided by the web sandboxing model. This can facilitate phishing attacks with higher fidelity, session hijacking attempts, or data exfiltration from sites that rely on strict origin isolation for security.
To mitigate this risk, users must upgrade Google Chrome to version 154.0.8037.57 or later immediately upon availability. For organizations managing large deployments of browsers, it is critical to ensure that automatic update policies are enabled and functioning correctly to prevent exposure during the window between vulnerability disclosure and patch deployment. Additionally, security administrators should monitor for indicators of compromise related to unusual network traffic patterns originating from browser processes, which may indicate exploitation attempts. Implementing strict content security policies on internal web applications can also provide an additional layer of defense by limiting the types of scripts and resources that can be loaded, thereby reducing the attack surface available to potential exploiters leveraging this specific flaw.
This vulnerability aligns with CWE-269, Improper Authorization, as it involves a failure to enforce proper access controls on system resources or functions. It also maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically in the context of using browser-based scripting environments to execute unauthorized actions within the user's session. Understanding these mappings helps security teams categorize the threat accurately and apply appropriate detection rules based on behavioral analytics that look for abnormal API calls or origin violations originating from web contexts.