Executive brief
A vulnerability in Google Chrome's graphics engine could allow a remote attacker to access sensitive information from the browser's memory. By tricking a user into visiting a specially crafted website, an attacker could potentially read data they are not authorized to see, such as information from other open tabs or internal browser processes. This issue has been addressed in the latest version of the Chrome browser.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in ANGLE, the graphics abstraction layer used by Google Chrome. The flaw is triggered when the browser processes a specially crafted HTML page, allowing a remote attacker to read memory outside of the intended buffer. This can lead to the disclosure of sensitive information from the browser's process memory. The vulnerability is reachable over the network without prior authentication, requiring only that a user navigate to a malicious site. Google has patched this issue in version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel
- 2026-06-04: disclosed: CVE published to NVD