CVE-2026-10922: Chrome DevTools Same-Origin Policy Bypass (CVSS 8.8)

Technical summary

This vulnerability exists in Chrome's DevTools component and relates to insufficient input validation (CWE-20). DevTools typically operates with elevated privileges and can interact with web content across origins under normal circumstances. When a developer opens or interacts with DevTools, an attacker can use crafted network traffic to manipulate DevTools behavior, circumventing the same-origin policy that usually prevents cross-origin data access. The vulnerability requires the user to perform specific UI gestures—likely opening DevTools or interacting with certain UI elements—making it a user-assisted but otherwise remotely exploitable flaw. The attack vector is network-based, attack complexity is low, and no elevated privileges are required from the attacker's perspective.

Business impact

Organizations and individuals relying on Chrome for secure browsing face meaningful risk. An attacker who exploits this could access sensitive data displayed in web applications, session tokens, or credentials entered in one origin from another origin context—effectively breaking the fundamental isolation that underpins web security. For businesses, this could lead to unauthorized access to internal applications, customer data exfiltration, or manipulation of business-critical web services. The high severity rating reflects the combination of confidentiality, integrity, and availability impacts. End users are at risk of credential theft and data compromise when visiting attacker-controlled or compromised websites.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are vulnerable. The underlying issue may also affect or be related to Chromium-based components on Windows, macOS, and Linux. Other Chromium-based browsers (Edge, Brave, Opera, etc.) may warrant investigation depending on their version and sync with upstream Chromium patches. Apple macOS and the Linux kernel are listed as affected platforms, likely indicating that Chrome on those operating systems requires patching. Windows systems running vulnerable Chrome versions are similarly at risk.

Exploitability

The vulnerability is readily exploitable in a practical sense: it requires only network access and user interaction (opening or using DevTools). No authentication is needed, and attack complexity is low. However, it does depend on social engineering or user behavior—convincing a user to open DevTools or engage in specific UI gestures while visiting a malicious site. This is feasible through watering-hole attacks, phishing, or compromised advertisements. Once those conditions are met, exploitation is straightforward. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, but its high severity and low barrier to exploitation mean active weaponization could occur.

Remediation

The immediate remedy is to update Google Chrome to version 149.0.7827.53 or later. Users should enable automatic updates in Chrome settings to ensure they receive this patch as soon as it rolls out. Organizations should validate patch deployment across their user base, especially for enterprise deployments. Additionally, consider restricting DevTools access in enterprise environments where feasible—some organizations disable DevTools for end users via group policy or browser configuration to reduce attack surface. Monitor for any signs of exploitation, such as unexpected data access or session hijacking.

Patch guidance

Google Chrome will deploy the fix in version 149.0.7827.53 or later. Verify the exact version released by checking Google's official security update page. Most users with auto-update enabled will receive the patch automatically within hours of the stable release. Enterprise administrators should test the patched version in a staging environment and then roll out via mobile device management (MDM) or group policy. For macOS and Linux users, ensure that Chrome updates are applied—package managers on Linux distributions should pull the patched version from upstream. After patching, force a browser restart to load the fixed binary.

Detection guidance

Detection during exploitation is challenging because the attack involves DevTools interaction and network traffic manipulation. Look for suspicious patterns: users with DevTools open accessing cross-origin resources, unusual network requests originating from or targeting DevTools components, or web application logs showing unexpected data access from unexpected origins. Monitor for sudden spikes in session hijacking or credential compromise correlated with Chrome usage. Endpoint detection and response (EDR) tools should flag abnormal Chrome process behavior or unusual inter-process communication. Network sensors looking for malicious payloads may detect the crafted network traffic if signatures are available post-analysis. Threat hunting should focus on identifying whether any user opened DevTools on a potentially malicious site during the vulnerability window.

Why prioritize this

This vulnerability merits immediate prioritization due to its high CVSS score (8.8), low attack complexity, and broad impact on confidentiality, integrity, and availability. Although user interaction is required, the barrier to social engineering DevTools interaction is low, especially in targeted campaigns. The same-origin policy is foundational to web security, and its bypass puts all sensitive web-based data at risk. Chrome's ubiquitous deployment across consumer and enterprise environments amplifies the blast radius. The absence of active exploitation in the KEV catalog provides a small window to patch before weaponization becomes widespread.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-accessible vulnerability with low attack complexity and no privilege requirements. The score is driven primarily by the three impact metrics—confidentiality, integrity, and availability are all marked as HIGH because a successful exploit allows an attacker to read, modify, or disrupt web application functionality across origins. The scope is unchanged (User), meaning the impact is limited to the vulnerable component and its direct trust boundary, not the entire system. The user interaction requirement (UI:R) prevents a perfect 9.0+ score but does not reduce severity below 8.0. The scoring reasonably represents the real-world danger of a same-origin policy bypass.

Frequently asked questions