Executive brief
Google Chrome is a widely used web browser. A vulnerability in the browser's Extensions component could allow an attacker who has already partially compromised the browser to gain higher-level system privileges. This could lead to unauthorized access to sensitive user data or the ability to execute malicious commands on the underlying operating system.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Extensions component of Google Chrome. The flaw allows a remote attacker to escalate privileges if they have already achieved code execution within a compromised renderer process. By enticing a user to visit a specially crafted HTML page, the attacker can exploit the lack of validation to bypass security boundaries. This vulnerability was addressed in version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel
- 2026-06-04: disclosed: CVE published