CVE-2026-12024: Chrome Same-Origin Policy Bypass in DevTools (CVSS 6.5)

Technical summary

CVE-2026-12024 is an insufficient policy enforcement vulnerability in Chrome's DevTools component, classified under CWE-346 (Origin Validation Error). The flaw permits a network-based attacker to circumvent same-origin policy protections through a specially crafted HTML page. Exploitation requires user interaction (visiting a malicious page) but no elevated privileges. The vulnerability carries a CVSS 3.1 score of 6.5 (Medium severity) with a vector reflecting network accessibility, low attack complexity, no privileges required, user interaction necessary, and integrity impact without confidentiality or availability compromise.

Business impact

If exploited, this vulnerability could allow attackers to perform unauthorized actions or access data within the context of legitimate websites—such as modifying account settings, stealing session tokens, exfiltrating personal information, or manipulating page content—affecting any user of vulnerable Chrome versions. For organizations, this means employees using Chrome could become vectors for credential theft, account hijacking, or data theft if social-engineered into visiting attacker-controlled pages. The integrity-focused impact (rather than data exfiltration) suggests attackers could modify or forge transactions or communications.

Affected systems

The vulnerability impacts Google Chrome releases prior to version 149.0.7827.115 across all major operating systems: Windows, macOS, and Linux. Any organization relying on Chrome for browser access—especially those without centralized patch management—faces exposure. Users on older release channels or those who delay patching remain at risk.

Exploitability

Exploitation requires a user to visit a malicious or compromised webpage, making it dependent on user interaction and social engineering. There is no evidence of active exploitation in the wild (KEV status: not listed). The attack requires no special privileges and has low technical complexity, making it a viable threat if an attacker can lure victims to their site or compromise legitimate web properties.

Remediation

Organizations should update Google Chrome to version 149.0.7827.115 or later without delay. Verify patch deployment across managed endpoints and encourage or enforce updates for unmanaged devices. Consider supplementary controls such as browser security policies, content security policy (CSP) headers on internal applications, and user awareness training on phishing and malicious links.

Patch guidance

Deploy Chrome version 149.0.7827.115 or newer across your infrastructure. Google's update mechanism is generally automatic for Chrome users, but verify completion on critical systems. For enterprise Chrome management, use the Admin Console to set update policies and confirm rollout. Test patches in a non-production environment first if your organization runs Chrome extensions or relies on specific web applications that may have compatibility concerns.

Detection guidance

Monitor for unusual DevTools usage patterns or same-origin policy violations in browser logs. Organizations with HTTP archive (HAR) logging or proxy inspection can flag suspicious requests that appear to originate from different domains within a single session context. Watch for users accessing unexpected origins from internal applications. Endpoint detection and response (EDR) tools may flag suspicious process chains if malicious JavaScript spawns child processes. User reports of unexplained account activity or unauthorized actions following visits to unfamiliar websites warrant investigation.

Why prioritize this

While the CVSS score is Medium (6.5), the practical risk is elevated due to the fundamental nature of same-origin policy and the prevalence of Chrome. Any integrity-impacting web-based vulnerability that affects billions of users warrants rapid patching, especially since exploitation is straightforward once a user visits an attacker's page. The lack of KEV listing does not diminish the threat—it reflects current intelligence rather than absence of exploitability.

Risk score, explained

The CVSS 6.5 reflects that integrity (not confidentiality or availability) is compromised and user interaction is required, lowering the score below 'High.' However, context matters: same-origin policy is critical to browser security, the vector is network-accessible, and Chrome's ubiquity means millions of potential targets. Organizations should treat this as higher-priority than the numeric score alone suggests.

Frequently asked questions