Google Chrome Extensions input validation flaw enables web origin policy bypass

Improper input validation in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a privileged page via crafted network traffic. (Chromium security severity: Low)

• Google Chrome: Affected before 153.0.8010.36; the structured record marks the product as affected with lessThan: 153.0.8010.36.
• Desktop builds in Google's release notice: The stable-channel notice lists 153.0.8010.36 for Linux and 153.0.8010.36/.37 for Windows/macOS in the update containing security fixes.
• The record does not separately enumerate every parallel release branch or platform build. Branches not explicitly covered remain unverified.

The flaw is in the Extensions component of Google Chrome and is classified as CWE-20, improper input validation. A remote attacker can provide crafted network traffic as input to the affected component. If that input is not validated correctly, Chrome may allow the attacker to bypass web origin policy into a privileged page. The available evidence does not identify the specific data field, parser, validation rule, extension API, or privileged page involved. Authentication, user interaction, and the exact triggering conditions are also not established.

• Reachability: The record describes a remote attacker exploiting through crafted network traffic.
• Authentication and user interaction: The record does not state whether authentication or user interaction is required.
• Complexity: The available evidence does not establish the complexity of exploitation.
• Exploitation status: The record does not establish exploitation in the wild or a public exploit.

The described technical outcome is a bypass of web origin policy into a privileged page. This may expand access beyond the normal web-origin boundary and affect the confidentiality or integrity of data exposed through that privileged page. The extent of impact depends on the target page and the Extensions context, which are not identified in the record. The available evidence does not confirm arbitrary code execution, account takeover, sandbox escape, or host compromise.

Successful exploitation could let an attacker cross normal web-origin boundaries and reach a privileged page. Depending on the data and operations exposed by that page, this could enable unauthorized access to protected browser data or functions. The practical consequence depends on the target page, extension privileges, and accessible data, none of which are specified in the available evidence. The record does not confirm data disclosure, data modification, code execution, sandbox escape, or service disruption.

1. Update Chrome using the vendor's stable desktop release containing the security fixes. Google's release notice lists 153.0.8010.36 for Linux and 153.0.8010.36/.37 for Windows/macOS.
2. After deployment, verify the installed version on each platform and ensure that affected systems no longer run a version before 153.0.8010.36.
3. Reconcile any other Chrome branches or platform-specific builds against Google's guidance rather than assuming that an unlisted branch is unaffected.
4. The record provides no confirmed workaround or configuration mitigation. Do not treat an unverified temporary control as a replacement for updating.

1. Inventory Google Chrome installations by platform and record the actual version on each device.
2. Compare each installed version with the affected boundary in affected_summary, prioritizing systems that use Extensions.
3. Verify Chrome update status and confirm that the fix has been deployed successfully across the relevant Windows, macOS, and Linux branches.
4. As a precaution, review browser and network telemetry for unusual web traffic attempting to reach privileged pages. This is precautionary monitoring, not a confirmed indicator of compromise.
5. Do not treat the absence of suspicious log activity as proof of safety. The record does not provide a specific log event or indicator.