Executive brief
A vulnerability in Google Chrome's developer tools (DevTools) could allow a malicious website to execute unauthorized scripts. If a user visits a specially crafted page and their browser's internal processes are already compromised, an attacker could bypass security boundaries to inject malicious code or steal information. This could lead to unauthorized access to user data or the ability to perform actions on behalf of the user across different websites.
Technical details
An improper input validation vulnerability exists in the DevTools component of Google Chrome. A remote attacker who has already achieved a renderer process compromise can exploit this flaw by convincing a user to visit a crafted HTML page. By providing malicious input that is insufficiently validated by DevTools, the attacker can perform a Universal Cross-Site Scripting (UXSS) attack, injecting arbitrary scripts or HTML into the context of other sites. This vulnerability is tracked as CVE-2026-10916 and was addressed in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-03-30: disclosed: Reported to Chrome by Google researchers.
- 2026-06-02: patched: Fixed in Chrome stable channel update 149.0.7827.53.
- 2026-06-04: advisory: NVD publication date.