CVE-2026-95361 in Chrome
Summary
by MITRE • 09/29/2026
Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as a confused deputy flaw within the DevTools component of Google Chrome prior to version 154.0.8037.57 represents a significant deviation from expected access control behaviors in web browsers. This issue stems from an improper authorization check where the browser fails to correctly verify whether the entity requesting access has sufficient privileges for that specific action, effectively allowing a lower-privileged actor to perform actions typically reserved for higher-privileged contexts or different origins. In this specific instance, the confusion arises when DevTools functionality is invoked through standard web pages rather than direct user interaction with the developer tools interface itself. The core technical flaw lies in the insufficient separation of privileges between the main page context and the privileged internal interfaces exposed by Chrome's debugging infrastructure. When a malicious HTML page triggers certain DevTool-related APIs or events, the browser incorrectly grants access to sensitive data or functionality that should be restricted by strict origin policies. This misconfiguration allows the attacker to exploit the trust relationship established when users enable developer tools for legitimate purposes, turning it into an attack vector against other web applications running in separate tabs or frames.
The operational impact of this vulnerability is primarily centered on the bypassing of the Same-Origin Policy (SOP), a critical security mechanism that isolates content from different origins to prevent malicious scripts from accessing data belonging to another origin. By leveraging social engineering techniques, an attacker can craft a deceptive HTML page that tricks a victim into enabling developer tools or interacting with specific browser features while visiting the malicious site. Once this interaction occurs, the confused deputy flaw allows the crafted script to access cross-origin resources, such as cookies, local storage, DOM elements, or network requests from other tabs where the user is logged into sensitive services like banking portals or email accounts. This bypass effectively neutralizes one of the most fundamental protections in web security, potentially leading to unauthorized data exfiltration, session hijacking, or further exploitation within the victim's authenticated sessions on those trusted sites. The severity rating of Low by Chromium reflects the complexity required for successful exploitation and the reliance on user interaction, but the potential consequences remain severe due to the direct compromise of isolation boundaries.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, specifically where an actor is granted privileges they should not possess based on their context or origin. It also relates closely to CWE-841, known as Improper Enforcement of Behavioral Workflow, because the browser's internal logic fails to enforce the correct sequence of checks before allowing access to DevTools features from untrusted origins. In terms of offensive security frameworks, this exploit technique maps to MITRE ATT&CK T1059, Command and Scripting Interpreter, specifically when used in conjunction with web-based scripting environments like JavaScript within a browser context. Furthermore, it falls under the broader category of client-side attacks that leverage trusted applications against other targets, similar to techniques described in T1204, User Execution, where social engineering is employed to initiate the malicious workflow. The attack vector relies heavily on the victim's own actions and trust in the browser environment, making detection difficult without behavioral analysis or strict content security policies.
Mitigation strategies for this vulnerability primarily involve updating Google Chrome to version 154.0.8037.57 or later, where the confused deputy flaw has been addressed through stricter validation of origin contexts when invoking DevTools APIs from external pages. For organizations unable to patch immediately, implementing strict Content Security Policy (CSP) headers can help mitigate some risks by restricting how scripts interact with browser internals and limiting data exfiltration channels. Additionally, user education remains critical; administrators should advise users against enabling developer tools on untrusted websites or using dedicated profiles for sensitive activities where DevTools might be inadvertently triggered. Monitoring network traffic for unusual cross-origin requests originating from tabs that have recently accessed developer tool interfaces can also aid in detecting potential exploitation attempts. Ultimately, the resolution requires both technical patching to enforce proper privilege boundaries and operational awareness regarding the risks associated with interactive browser features on untrusted domains.