Executive brief
Google Chrome is a widely used web browser. A vulnerability in its networking component could allow a remote attacker who has already partially compromised the browser to access sensitive information stored in the computer's memory. This could lead to the exposure of private data or credentials from other open tabs or browser processes.
Technical details
This vulnerability is classified as improper input validation (CWE-20) within the Network component of Chromium. The flaw allows an attacker who has already achieved code execution within a sandboxed renderer process to bypass certain memory protections. By enticing a user to visit a specially crafted HTML page, the attacker can leverage this insufficient validation to read sensitive data from the process memory. This is a post-compromise information disclosure primitive. The issue is resolved in Google Chrome version 149.0.7827.53 and later.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel
- 2026-06-04: disclosed: CVE published to NVD