CVE-2026-1504
📋 TL;DR
This vulnerability in Google Chrome's Background Fetch API allows attackers to leak cross-origin data through specially crafted HTML pages. It affects users running Chrome versions before 144.0.7559.110. The issue enables unauthorized access to data from different origins, potentially exposing sensitive information.
💻 Affected Systems
- Google Chrome
- Chromium-based browsers
📦 What is this software?
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal sensitive cross-origin data including authentication tokens, session cookies, or private user information from other websites the victim is logged into.
Likely Case
Malicious websites could extract limited cross-origin data such as user identifiers, partial page content, or metadata from other sites the user visits.
If Mitigated
With proper browser updates and security controls, the risk is eliminated as the vulnerability is patched in current Chrome versions.
🎯 Exploit Status
Exploitation requires user interaction (visiting a malicious webpage) but no authentication. The technical details are not publicly disclosed in detail.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 144.0.7559.110 and later
Vendor Advisory: https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_27.html
Restart Required: Yes
Instructions:
1. Open Chrome and click the three-dot menu
2. Go to Help > About Google Chrome
3. Chrome will automatically check for updates and install version 144.0.7559.110 or later
4. Click 'Relaunch' to restart Chrome with the fix
🔧 Temporary Workarounds
Disable Background Fetch API
allTemporarily disable the vulnerable Background Fetch API via Chrome flags
chrome://flags/#enable-background-fetch
Set to 'Disabled'
Use Site Isolation
allEnable strict site isolation to limit cross-origin data exposure
chrome://flags/#enable-site-per-process
Set to 'Enabled'
🧯 If You Can't Patch
- Implement web application firewalls (WAF) to block malicious HTML pages attempting exploitation
- Use browser isolation technologies to render web content in isolated environments
🔍 How to Verify
Check if Vulnerable:
Check Chrome version: If version is less than 144.0.7559.110, the system is vulnerableCheck Version:
chrome://version/ or 'google-chrome --version' on Linux/macOS terminalVerify Fix Applied:
Confirm Chrome version is 144.0.7559.110 or higher after update📡 Detection & Monitoring
Log Indicators:
- Unusual Background Fetch API usage patterns
- Multiple cross-origin fetch requests from single pages
Network Indicators:
- Suspicious data exfiltration patterns from browser to external servers
SIEM Query:
source="chrome_audit_logs" AND event="background_fetch" AND destination_domain!=source_domain