CVE-2026-95340 in Chrome
Summary
by MITRE • 09/29/2026
Incorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as an incorrect authorization flaw within the PictureInPicture feature of Google Chrome prior to version 154.0.8037.57 represents a significant breach in web origin policy enforcement. This issue stems from a logic error where the browser fails to properly validate whether a webpage has legitimate permission to initiate or control picture-in-picture mode for specific media elements. In standard web security models, origins are isolated to prevent malicious scripts on one site from accessing data or performing actions on behalf of another trusted site. However, in this instance, the authorization check was insufficiently rigorous, allowing a crafted HTML page hosted by an attacker to manipulate the browser's multimedia handling subsystem without proper user consent or origin verification.
From a technical perspective, the flaw resides in how Chrome handles state transitions for embedded media players when they are requested to enter picture-in-picture mode. The vulnerability allows a remote attacker to leverage social engineering techniques to trick users into visiting a malicious webpage containing specially crafted HTML and JavaScript code. When executed, this code exploits the authorization gap by triggering the PictureInPicture API without adhering strictly to cross-origin restrictions. This effectively bypasses the same-origin policy, which is designed to prevent unauthorized access between different web contexts. The Chromium security team has classified this issue with a low severity rating, likely due to the high degree of user interaction required and the specific nature of the feature involved, but it still poses a tangible risk to privacy and data integrity.
The operational impact of this vulnerability centers on potential information leakage and unauthorized media control. By bypassing origin policies, an attacker could potentially access sensitive content displayed within picture-in-picture windows or manipulate playback controls in ways that were not intended by the user or the hosting site. This can lead to scenarios where private video streams are exposed or manipulated without explicit permission. Furthermore, because the attack relies on social engineering, it targets human trust rather than just software weaknesses, making it particularly dangerous in phishing campaigns aimed at stealing credentials or spreading malware through deceptive media interactions.
To mitigate this risk, users must ensure that their Google Chrome browser is updated to version 154.0.8037.57 or later, where the authorization logic for PictureInPicture has been corrected. Administrators should enforce automatic update policies across all endpoints to prevent exposure during the window of vulnerability. Additionally, security awareness training can help users recognize and avoid suspicious links that attempt to exploit multimedia features through crafted web pages. From a defensive architecture standpoint, implementing strict Content Security Policy headers can further restrict how media elements are embedded and controlled on websites, adding an additional layer of defense against origin bypass attempts.
This incident aligns with Common Weakness Enumeration (CWE) category CWE-269, which covers Improper Authorization, specifically highlighting failures in enforcing access control for critical functions. It also relates to ATT&CK technique T1059, Command and Scripting Interpreter, as the exploitation involves executing malicious scripts within a browser context to achieve unauthorized actions. Understanding these mappings helps security teams categorize similar future incidents and apply appropriate patch management strategies effectively.