CVE-2026-95352 in Chrome
Summary
by MITRE • 09/29/2026
Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as an incorrect authorization flaw within the DevTools component of Google Chrome prior to version 154.0.8037.57 represents a significant deviation from expected access control mechanisms in browser developer tools. This issue specifically affects the privilege escalation boundaries that are typically enforced between standard web content and privileged browser interfaces. The core technical flaw lies in how the DevTools subsystem validates user intent and context when interacting with extensions or remote debugging protocols, allowing for an unauthorized bypass of the same-origin policy under specific conditions involving crafted Chrome extensions.
The operational impact of this vulnerability is primarily realized through social engineering tactics rather than purely automated exploitation. An attacker must craft a malicious Chrome extension that appears legitimate to the victim user. Once installed by the user who has granted necessary permissions, the extension can leverage the misconfigured authorization logic within DevTools to execute scripts or access data across different origins without proper restriction. This effectively neutralizes one of the most fundamental security models in web browsers, which is designed to isolate content from different sources to prevent unauthorized data access and cross-site scripting attacks.
From a classification perspective, this vulnerability aligns with CWE-269, Improper Privilege Assignment, as it involves granting capabilities to an actor that exceed their intended level of trust or authority within the application context. Furthermore, in terms of adversary behavior mapping according to MITRE ATT&CK techniques, this flaw facilitates T1059 Command and Scripting Interpreter execution via browser extensions and potentially supports T1078 Valid Accounts if the attacker leverages legitimate-looking credentials or permissions obtained through deception. The low severity rating assigned by Chromium reflects the high barrier of entry for exploitation due to the requirement for user interaction and extension installation, but it does not diminish the potential for data exfiltration or session hijacking once the initial foothold is established.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. The primary remediation step is to update Google Chrome to version 154.0.8037.57 or later, where these authorization checks have been corrected to enforce strict origin validation within the DevTools interface. For organizations managing large fleets of browsers, deploying this patch via centralized management tools is critical to ensure uniform protection against extension-based attacks. Additionally, users should be educated on the risks associated with installing third-party extensions and advised to review permissions carefully before granting access to sensitive browsing data or developer tool capabilities. Implementing browser policies that restrict the installation of unauthorized extensions can further reduce the attack surface by preventing the deployment of crafted malicious tools in enterprise environments.