CVE-2026-95375 in Chrome
Summary
by MITRE • 09/29/2026
Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as an incorrect authorization flaw within Google Chrome's BrowserTag component represents a significant breach in the browser's multi-process architecture, specifically targeting the isolation mechanisms that enforce web origins. This issue existed prior to version 154.0.8037.57 and was classified with a medium security severity by the Chromium team. The core of the problem lies in the improper handling of authorization checks when BrowserTag interacts with other browser components, creating an avenue for privilege escalation from a lower-privilege context to one that can bypass strict origin policies.
In modern web browsers like Chrome, processes are segregated into different sandbox levels to limit the damage caused by malicious code execution. The renderer process is typically heavily restricted and operates under low privileges to prevent it from accessing sensitive system resources or other tabs' data. However, when a remote attacker compromises the renderer process through an exploit such as a cross-site scripting attack or a memory corruption vulnerability in JavaScript engine components, they gain control over that isolated environment. Under normal circumstances, this compromise should not allow access to data outside of the originating web page due to strict same-origin policies enforced by the browser's security model.
The technical flaw involves BrowserTag failing to properly validate authorization tokens or permissions when performing operations that bridge the gap between the renderer and higher-privilege processes like the browser process. By crafting a specific HTML page, an attacker can trigger this misconfiguration, causing the browser to incorrectly authorize actions that should be denied. This allows the compromised renderer to send commands or access resources across different origins without proper authentication checks being applied correctly. Consequently, the strict boundaries designed to keep malicious scripts confined to their origin are effectively neutralized for specific operations handled by BrowserTag.
The operational impact of this vulnerability is substantial because it enables a remote attacker who has already achieved code execution within a renderer process to bypass web origin policies. This means that an attacker could potentially read sensitive data from other tabs, such as banking sessions or personal emails, if those sites are open in the same browser instance. It also allows for potential cross-site request forgery attacks where actions on behalf of authenticated users can be performed without their knowledge. The ability to bypass origin policies undermines one of the fundamental security guarantees provided by web browsers, leading to data leakage and unauthorized state changes across different domains.
From a classification perspective, this vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it involves an actor obtaining privileges or access they are not authorized for within the application's logic. Furthermore, in terms of the MITRE ATT&CK framework, this behavior is consistent with techniques related to Defense Evasion and potentially Lateral Movement if the attacker uses the compromised renderer to pivot into other contexts. The specific mechanism of bypassing origin policies via crafted HTML pages falls under web-based attack vectors that exploit browser implementation flaws rather than server-side vulnerabilities.
Mitigation for this issue primarily relies on updating Google Chrome to version 154.0.8037.57 or later, where the authorization checks in BrowserTag have been corrected to ensure proper validation before allowing cross-origin interactions. Users and organizations should enable automatic updates to ensure timely patching of such vulnerabilities as they are discovered by the Chromium team. Additionally, implementing Content Security Policy headers can provide an additional layer of defense by restricting how resources are loaded and executed within web pages, reducing the attack surface even if a renderer compromise occurs. For enterprise environments, deploying browser hardening configurations that restrict certain APIs or features used in BrowserTag interactions may further mitigate the risk until patches are fully deployed across all endpoints.