Chrome Region Capture Cross-World Promise Leak

A malicious webpage may obtain a Promise and associated JavaScript objects from an extension content script's isolated world. This can expose extension-world intrinsic prototypes and enable cross-world prototype modification or attacker-controlled inherited getters to execute when extension code accesses affected objects. The issue can permit access to extension-private objects and properties, invocation of existing extension-world functions, and mutation of extension-owned objects. No native memory corruption, browser-process compromise, sandbox escape, or direct OS command execution is established for this vulnerability.

Until updated, limit installation and execution of untrusted extensions and avoid exposing sensitive extension content-script behavior to untrusted page DOM contexts. Extension developers should treat page-controlled DOM objects and values as untrusted and avoid relying on mutable shared prototypes across page and isolated worlds. These measures reduce exposure but do not fully correct the browser-level isolation failure.

Update Google Chrome to version 154.0.8037.57 or later on Windows, and to the corresponding Chrome 154 Stable release for the applicable platform. The Chromium fix creates distinct ScriptPromiseResolver instances for each caller ScriptState and queues resolvers per element until the MediaStream Mojo callback completes, resolving or rejecting each queued resolver independently.