Google Chrome DOM Observable Discrepancy Can Expose Sensitive Information

Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

• The record identifies Google Chrome as the affected product.
• Versions less than 153.0.8010.36 are marked affected.
• The Chrome release notice identifies 153.0.8010.36 for Linux and 153.0.8010.36/.37 for Windows and Mac in the related stable-channel release.
• The supplied evidence does not establish the status of other branches or platforms beyond these boundaries.

Google Chrome from Google contains an observable discrepancy in the DOM component. A crafted HTML page can create an observable difference in how the browser processes or exposes DOM-related behavior, allowing a remote attacker to obtain sensitive information when a user visits the content. The recorded attack conditions include network reachability, no prior privileges, and required user interaction, with social engineering available as the mechanism for persuading a user to open or visit the page. The exact DOM comparison, disclosed data, and technical path from the discrepancy to information collection are not established by the accessible evidence.

The issue is remotely reachable through a crafted HTML page. The attacker does not need prior authentication or privileges, but user interaction is required, and the vendor description specifically identifies social engineering as a possible way to obtain that interaction. The supplied record does not confirm exploitation in the wild and does not identify a public exploit; this should not be interpreted as proof that exploitation has never occurred. The related Chromium issue is access-restricted, so publicly available technical exploitation detail remains limited.

The recorded technical outcome is disclosure of sensitive information through DOM behavior processed by the browser. Exploitation requires user interaction and no prior privileges, so exposure is concentrated in browsing sessions where a user is persuaded to visit attacker-controlled HTML content. The supplied assessment indicates a confidentiality impact, while it does not identify an integrity or availability impact. The record provides no evidence that this issue enables code execution, sandbox escape, or system takeover.

The primary business risk is loss of confidentiality for users and organizations deploying Google Chrome.

1. Update affected Chrome endpoints promptly through Google's stable update channel.
2. For Linux, deploy 153.0.8010.36 as identified in the release notice.
3. For Windows and Mac, deploy the announced 153.0.8010.36/.37 release for the applicable platform and package.
4. Reconcile endpoint inventory after deployment and verify that systems are no longer running a version less than 153.0.8010.36.
5. Until updates are complete, advise users not to open suspicious links or untrusted HTML pages. The record does not provide a separate mitigation that replaces updating.

Review browser inventory and update status on endpoints that may still run affected Chrome versions.