Executive brief
A vulnerability in Google Chrome's video processing components could allow a remote attacker to access sensitive data from other websites. This issue occurs if an attacker has already partially compromised the browser's rendering process and then uses a specially crafted video file to bypass security boundaries. Successful exploitation could lead to the theft of private information, such as login tokens or personal data, from different web domains.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Codecs component of Google Chrome. The flaw allows a remote attacker who has achieved a prior compromise of the renderer process to bypass Same-Origin Policy (SOP) restrictions. By providing a specially crafted video file, the attacker can trigger the vulnerability to leak cross-origin data. This is classified by Chromium as a High severity issue and was addressed in version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE-2026-10981 published.