Executive brief
A security vulnerability exists in Google Chrome's DevTools, a set of web developer tools built directly into the browser. An attacker who has already partially compromised the browser's rendering process could use this flaw to bypass security boundaries that normally prevent different websites from accessing each other's data. This could lead to the unauthorized access of sensitive information from other open tabs or websites.
Technical details
An improper input validation vulnerability (CWE-20) exists in the DevTools component of Google Chrome. The flaw allows a remote attacker who has already achieved code execution within a compromised renderer process to bypass the Same-Origin Policy (SOP). By enticing a user to visit a specially crafted HTML page, the attacker can exploit the insufficient validation of untrusted input within DevTools to access data across different origins. This vulnerability was addressed in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel
- 2026-06-04: disclosed: CVE published to NVD dataset