Executive brief
A security vulnerability in Google Chrome could allow an attacker to bypass the Same Origin Policy, which is a fundamental security boundary that prevents websites from accessing each other's data. If an attacker has already compromised a user's browser rendering process, they could use a specially crafted webpage to steal sensitive information from other open websites. This could lead to the exposure of personal data, login sessions, or private communications.
Technical details
A vulnerability exists in the Network component of Google Chrome due to insufficient validation of untrusted input. An attacker who has already achieved code execution within a compromised renderer process can exploit this flaw via a crafted HTML page to bypass the Same Origin Policy (SOP). This bypass allows the attacker to perform unauthorized cross-origin data access. The issue is resolved in Google Chrome version 149.0.7827.53 and later. Chromium developers have classified this as Medium severity.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE published in NVD.