CVE-2026-10980: Chrome Same-Origin Policy Bypass in DevTools – Patch Guidance

Technical summary

CVE-2026-10980 stems from insufficient input validation in Chrome's Developer Tools component. The vulnerability exists in the renderer process and permits an attacker with renderer compromise to craft a specially designed HTML page that circumvents same-origin policy enforcement. This is classified as CWE-20 (Improper Input Validation). The attack requires prior renderer process compromise, meaning the attacker must already have code execution in the browser tab context before leveraging this flaw to escalate their access capabilities.

Business impact

If exploited in the wild, this vulnerability could lead to data theft from other open website sessions, session hijacking, or credential harvesting. For organizations where employees use Chrome for sensitive work (banking, email, SaaS access), a compromised renderer could be weaponized to harvest cross-origin data. The requirement for prior renderer compromise moderates the risk in typical user scenarios, but targeted attacks against high-value targets (developers, researchers, finance professionals) may justify prioritization.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are affected. This includes all stable, beta, and extended-release channels of Chrome on Windows, macOS, Linux, Android, and iOS running vulnerable versions. Chromium-based browsers that incorporate the affected code path may also be impacted; verify with vendor documentation for edge browsers, Brave, Opera, or other Chromium derivatives.

Exploitability

Exploitation requires two conditions: (1) the attacker must first compromise the renderer process (via a separate vulnerability, malicious script injection, or other means), and (2) the user must then visit a crafted HTML page while the renderer is compromised. This two-stage requirement reduces the attack surface compared to remote code execution vulnerabilities. However, the logic flaw itself is not inherently difficult to weaponize once renderer access is achieved. Public exploit code is not known to exist as of publication, and this CVE has not been added to the CISA Known Exploited Vulnerabilities catalog.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Chrome typically auto-updates on restart; users can manually check for updates via Chrome menu > About Google Chrome. Organizations managing Chrome deployments should use Group Policy (Windows), managed preferences (macOS), or Mobile Device Management (MDM) to enforce the patched version. For Chromium-based derivatives, consult vendor-specific advisory and patch timelines.

Patch guidance

1. Users: Restart Chrome to trigger the auto-update mechanism or manually navigate to About Chrome to force update checks. 2. Administrators: Deploy version 149.0.7827.53 or later via your centralized update mechanism (WSUS, Jamf, Intune, MDM platform). 3. Organizations using extended-release channels should confirm that version 149.0.7827.53 is available in their deployment channel before mandating updates. 4. Verify patch application by checking Chrome://version in a new tab; confirm the version number matches or exceeds 149.0.7827.53.

Detection guidance

Monitor Chrome version inventory across your environment to identify instances running pre-149.0.7827.53 builds. Endpoint Detection and Response (EDR) tools should flag instances of Chrome process injection or unusual renderer process spawning, which may indicate exploitation attempts. Web Isolation or Enhanced Safe Browsing modes in Chrome can provide additional defense by sandboxing suspicious content. Network-based detection is challenging since the attack occurs post-renderer-compromise; focus on behavioral indicators such as anomalous cross-origin data exfiltration or unusual script execution patterns.

Why prioritize this

Although the CVSS score is 6.5 (MEDIUM) and the vulnerability is not yet on CISA's KEV list, the nature of same-origin policy bypass combined with Chrome's ubiquity in enterprise environments warrants near-term patching. The two-stage exploitation requirement (prior renderer compromise) prevents this from being critical, but it should not be deprioritized indefinitely. Organizations should patch within 30 days as part of routine Chrome maintenance, sooner if any evidence of renderer compromise (malware, watering hole attacks) is detected in the environment.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects attack complexity and user interaction requirements. Network-based delivery (AV:N), low attack complexity (AC:L), and no privilege requirement (PR:N) inflate the base score. However, user interaction is required (UI:R), scope is unchanged (S:U), and there is no confidentiality loss (C:N) to the user—only integrity compromise (I:H) to the same-origin security model. The score balances the severity of same-origin policy bypass against the practical requirement of prior renderer compromise, landing in the MEDIUM range rather than HIGH.

Frequently asked questions