CVE-2026-102320: Google Chrome CORS Auth Bypass Vulnerability

CVE-2026-102320 Overview

CVE-2026-102320 is a missing authorization vulnerability [CWE-862] in the Cross-Origin Resource Sharing (CORS) implementation of Google Chrome. The flaw affects Chrome versions prior to 154.0.8037.92. A remote attacker who has already compromised the renderer process can bypass web origin policy through a crafted HTML page. Google classified the Chromium security severity as Medium.

The vulnerability weakens browser sandbox guarantees around same-origin enforcement. Successful exploitation lets an attacker access cross-origin resources that CORS should have restricted.

Critical Impact
An attacker with a compromised renderer can bypass same-origin protections and read data from origins the user is authenticated to.

Affected Products

Google Chrome for Desktop versions prior to 154.0.8037.92
Chromium-based browsers incorporating the affected CORS code
Embedded frameworks that ship Chromium content modules below the patched build

Discovery Timeline

2026-09-29 - CVE-2026-102320 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-102320

Vulnerability Analysis

The vulnerability sits in Chrome's CORS enforcement path. CORS is the browser mechanism that decides whether a script running in one origin may read a response from another origin. Missing authorization checks in this path allow a compromised renderer to fetch or read cross-origin data that policy should block.

Exploitation requires an existing renderer compromise, typically achieved through a separate memory corruption or type confusion bug. Once inside the renderer, an attacker uses this flaw to widen access from a single origin to arbitrary origins the browser holds credentials for. See the Chromium Issue Tracker Entry and the Google Chrome Stable Update for the vendor record.

Root Cause

The defect maps to [CWE-862] Missing Authorization. A code path in the CORS enforcement logic fails to verify that the requesting context is permitted to obtain the target cross-origin response. The browser process trusts a decision that should have been re-validated, so the origin boundary collapses when the renderer supplies crafted input.

Attack Vector

The attack chains two stages. First, the attacker compromises the renderer through a separate vulnerability or a malicious page loaded by the victim. Second, the attacker serves a crafted HTML page that abuses the missing authorization check to issue cross-origin requests and read their responses.

Targets include authenticated session data, tokens, and content from origins the user is logged into. Because the browser process honors the request, standard CORS response filtering does not apply. No verified public exploit code is available at this time.

Detection Methods for CVE-2026-102320

Indicators of Compromise

Chrome browser processes on versions below 154.0.8037.92 making unexpected cross-origin fetches to authenticated endpoints.
Renderer processes spawning outbound requests to sensitive internal services or SaaS APIs that do not match the loaded top-level origin.
Web application logs showing successful cross-origin reads from origins that should be blocked by CORS.

Detection Strategies

Inventory installed Chrome and Chromium-derived browser versions across managed endpoints and flag any build older than 154.0.8037.92.
Correlate browser process telemetry with network egress to identify anomalous cross-origin request patterns from a single tab or renderer.
Monitor server-side CORS preflight and actual request logs for unusual Origin headers on sensitive endpoints.

Monitoring Recommendations

Enable EDR visibility on chrome.exe child processes and their network connections to capture renderer-initiated activity.
Alert on Chrome installations that fail to auto-update within a defined window after the patch release.
Track authentication and session-token access on internal web applications for anomalies consistent with cross-origin scraping.

How to Mitigate CVE-2026-102320

Immediate Actions Required

Update all Google Chrome installations to version 154.0.8037.92 or later on Windows, macOS, and Linux.
Restart Chrome after the update completes so the patched binaries take effect in every renderer.
Update Chromium-based browsers and embedded Chromium runtimes to a build that incorporates the CORS fix.

Patch Information

Google addressed CVE-2026-102320 in the Chrome Stable channel at version 154.0.8037.92. Refer to the Google Chrome Stable Update release notes and the Chromium Issue Tracker Entry for change details. Enterprises using managed Chrome deployments should confirm the patched build is pushed through their update policy.

Workarounds

No official workaround replaces the patch; upgrading Chrome is the required remediation.
Reduce exposure by restricting untrusted browsing on high-value accounts until the patch is confirmed deployed.
Enforce strong site isolation and disable unnecessary browser extensions that could increase renderer attack surface.

bash

# Verify installed Chrome version meets the patched build
google-chrome --version
# Expected output: Google Chrome 154.0.8037.92 or later