Executive brief
A vulnerability in Google Chrome's graphics engine could allow a malicious website to access data from other open websites or browser tabs. This bypasses the browser's security boundaries that normally keep information from different sites separate. An attacker could exploit this by tricking a user into visiting a specially crafted webpage, potentially leading to the theft of sensitive user information.
Technical details
An integer overflow vulnerability exists in ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction layer used by Google Chrome. The flaw occurs when processing specific content within a crafted HTML page, leading to a memory safety issue that allows for cross-origin data leakage. A remote attacker can exploit this by hosting a malicious website that, when visited by a victim, bypasses the Same-Origin Policy (SOP). This allows the attacker to read data from other origins that the user is currently authenticated to or browsing. The issue is addressed in Chrome version 148.0.7778.216 and later.
Affected products
- Google Chrome Prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Stable channel update released
- 2026-05-28: disclosed: NVD publication date