CVE-2026-15124: Chrome Same-Origin Policy Bypass Allows Password Disclosure

Technical summary

CVE-2026-15124 involves insufficient policy enforcement in Chrome's password handling mechanism prior to version 150.0.7871.115. The vulnerability allows circumvention of the same-origin policy (SOP) through a specially crafted HTML page, enabling unauthorized information disclosure. The issue is classified as CWE-20 (Improper Input Validation), indicating that the browser fails to properly validate or enforce origin boundaries in certain password-related contexts. The attack vector is network-based, requires low complexity, and mandates user interaction but no elevated privileges. The flaw results in confidentiality impact with no integrity or availability consequences.

Business impact

While the CVSS score is MEDIUM (4.3), the real-world impact centers on credential compromise. If an attacker successfully exploits this flaw, they could harvest passwords or session tokens from users visiting their malicious page while authenticated to Gmail, corporate SSO systems, or other sensitive services. For organizations, this translates to potential lateral movement, account takeover, and unauthorized access to downstream systems. Financial services, healthcare, and enterprises relying on browser-based authentication face elevated risk. The requirement for user interaction (visiting a malicious site) limits exposure compared to zero-click attacks, but phishing campaigns, watering hole attacks, or ad-network compromises could deliver the payload at scale.

Affected systems

Google Chrome versions prior to 150.0.7871.115 are affected. This includes all supported release channels (Stable, Beta, Dev, Canary) running older builds. Chromium-based browsers built from affected upstream code (Edge, Brave, Opera, etc.) may also be vulnerable depending on their version synchronization and patching practices. Verify your organization's Chrome deployment version and any third-party Chromium-based applications currently in use.

Exploitability

Exploitation requires crafting a malicious HTML page and convincing or tricking a user into visiting it while logged into a sensitive account. The attack is not remotely exploitable without user interaction—there is no network-based worm or drive-by download component. Once a user lands on the attacker's page, the browser vulnerability is triggered automatically. The low complexity and lack of privilege requirements make this a moderately attractive target for phishing campaigns, but it does not meet the criteria for CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code availability has been indicated; however, the attack methodology is conceptually straightforward once the vulnerability is disclosed.

Remediation

Update Google Chrome to version 150.0.7871.115 or later immediately. Chrome's auto-update mechanism should deliver this patch automatically, but verification is recommended for air-gapped or managed deployments. Users can manually check by navigating to Chrome menu > Help > About Google Chrome and allowing any pending updates to install. Organizations should verify patch rollout across their fleet and confirm no legacy or offline instances remain on vulnerable versions. For Chromium-based alternatives, cross-reference the upstream fix timeline and apply equivalent patches.

Patch guidance

Google released the fix in Chrome 150.0.7871.115. Patch management should prioritize this update, particularly for users and systems handling sensitive credentials or financial transactions. Test the patch in a non-production environment if your organization maintains strict change control. Auto-update is enabled by default; disable notifications if needed but do not defer patching. Organizations using Google's Chrome Enterprise offerings can deploy via group policy or MDM. Verify patch success by checking the Chrome version string under About and confirming no password-related policy bypasses are accessible via test HTML payloads.

Detection guidance

Detection of exploitation attempts is challenging because the attack vector is a crafted HTML page visited by the user. Network-based detection is unlikely to catch the initial compromise, but behavioral indicators include: (1) unusual outbound connections from Chrome processes to attacker infrastructure after visiting untrusted sites; (2) unauthorized password changes or account lockouts on sensitive accounts coinciding with user phishing or malicious site visits; (3) authentication logs showing logins from unexpected geographies or times correlated with the exploitation window. Browser-side detection is limited; however, security teams should monitor for phishing campaigns delivering links to suspicious domains and correlate with user reports of account compromise. Endpoint detection and response (EDR) solutions can flag suspicious child processes spawned by Chrome or abnormal file/registry writes related to credentials.

Why prioritize this

Although the CVSS score is MEDIUM, this vulnerability warrants urgent patching because it directly undermines browser-based authentication security—a foundational trust boundary for enterprise and consumer operations. The fact that it bypasses the same-origin policy, one of the web's core security pillars, elevates its strategic importance. Organizations handling financial services, healthcare, or government data should treat this as a Priority 1 patch. The requirement for user interaction reduces the immediate blast radius, but phishing and social engineering amplify the risk. Patch deployment should be completed within 48-72 hours for critical user populations.

Risk score, explained

The CVSS 4.3 MEDIUM score reflects limited attack complexity, no privilege escalation, and user interaction requirement, but accounts for direct confidentiality impact (information disclosure). The score does not fully capture the strategic damage of compromising the same-origin policy—a foundational browser security model—or the likelihood of exploitation via phishing. Organizations with high-value credential targets (finance, government, healthcare) should apply a multiplier and treat this as High priority internally, even if the base CVSS is MEDIUM.

Frequently asked questions