CVE-2026-15124: Google Chrome Auth Bypass Vulnerability

CVE-2026-15124 Overview

CVE-2026-15124 is a same-origin policy bypass in the Passwords component of Google Chrome. The flaw stems from insufficient policy enforcement and allows a remote attacker to bypass same-origin policy by luring a user to a crafted HTML page. Chromium rates the security severity as High, while NVD assigns a CVSS score of 4.3 reflecting the required user interaction and limited confidentiality impact. Google addressed the issue in Chrome Stable 150.0.7871.115. The weakness is classified under [CWE-20] Improper Input Validation.

Critical Impact
A remote attacker can bypass the same-origin policy through a crafted web page, exposing stored password data across origin boundaries in Chrome versions prior to 150.0.7871.115.

Affected Products

Google Chrome versions prior to 150.0.7871.115
Chromium-based browsers using the vulnerable Passwords component
Desktop Chrome Stable channel across Windows, macOS, and Linux

Discovery Timeline

2026-07-08 - CVE-2026-15124 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-15124

Vulnerability Analysis

The vulnerability resides in Chrome's Passwords subsystem, which manages saved credentials and autofill behavior. Insufficient policy enforcement in this component permits a crafted HTML page to bypass the same-origin policy (SOP). SOP is the browser primitive that isolates documents from different origins and prevents scripts on one origin from reading data associated with another.

When SOP checks are incomplete around password-related flows, an attacker-controlled page can trigger interactions that expose credential material or state that should remain scoped to a different origin. Exploitation requires the victim to load the malicious page, which aligns with the CVSS UI:R designation. The attack complexity is low and no authentication is required on the attacker side.

Root Cause

The root cause is improper enforcement of origin boundaries within Chrome's password-handling logic, mapped to [CWE-20]. Origin checks were either missing or applied inconsistently along a code path reachable from untrusted web content, allowing cross-origin behavior that the SOP is designed to prevent.

Attack Vector

Exploitation is network-based and delivered through a crafted HTML document. An attacker hosts the page and induces a user to visit it through phishing, malvertising, or a compromised site. Once loaded, the page issues DOM or navigation operations that leverage the policy gap in the Passwords component to interact with credentials or state associated with another origin.

No verified public exploit code is available. Technical specifics remain restricted in the Chromium Issue Tracker #523735038 pending broader user patch adoption.

Detection Methods for CVE-2026-15124

Indicators of Compromise

Chrome browser processes reporting versions earlier than 150.0.7871.115 in enterprise inventory data
Outbound connections from browsers to newly registered or low-reputation domains hosting HTML pages with unusual credential-form interactions
Anomalous password autofill events or credential prompts triggered on domains that do not match the user's stored password origins

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 150.0.7871.115
Correlate browser telemetry with proxy or DNS logs to identify user visits to attacker-controlled pages preceding credential misuse
Monitor identity providers for authentication anomalies that could indicate credential replay following a successful browser-side bypass

Monitoring Recommendations

Enable browser management reporting through Chrome Browser Cloud Management to track version compliance in real time
Ingest browser and endpoint logs into a centralized analytics platform to detect version drift and suspicious page loads at scale
Alert on password manager or autofill events that occur outside of expected origins for high-value accounts

How to Mitigate CVE-2026-15124

Immediate Actions Required

Update Google Chrome to version 150.0.7871.115 or later on all desktop platforms
Restart Chrome after the update to ensure the patched binaries are loaded into every browser process
Force a managed update through group policy or MDM to eliminate reliance on user-initiated relaunches

Patch Information

Google released the fix in the Chrome Stable channel at version 150.0.7871.115. Refer to the Google Chrome Stable Update advisory and Chromium Issue Tracker #523735038 for release notes and disclosure status. Chromium-based browsers should apply the corresponding upstream fix once vendors publish downstream releases.

Workarounds

Restrict browsing to trusted sites through enterprise URL filtering until patch deployment completes
Disable Chrome's built-in password manager in favor of a hardened third-party solution where operationally feasible
Use policy controls such as PasswordManagerEnabled and URLBlocklist to reduce exposure to crafted HTML pages while updates roll out

bash

# Configuration example: enforce minimum Chrome version and restrict password manager via policy
# Windows registry (managed Chrome policy)
reg add "HKLM\Software\Policies\Google\Chrome" /v PasswordManagerEnabled /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "150.0.7871.115" /f

# Linux managed policy (/etc/opt/chrome/policies/managed/cve-2026-15124.json)
# {
#   "PasswordManagerEnabled": false,
#   "TargetVersionPrefix": "150.0.7871.115"
# }