Executive brief
Google Chrome is a widely used web browser. A vulnerability in the way the browser handles web application installations could allow a malicious website to bypass security boundaries known as the Same Origin Policy. If exploited, an attacker who has already gained some control over the browser's rendering process could potentially access or interact with data from other websites, leading to unauthorized data access or session interference.
Technical details
A vulnerability exists in the WebAppInstalls component of Google Chrome due to an inappropriate implementation of security checks. The root cause is categorized as improper input validation (CWE-20). An attacker who has already achieved code execution within a compromised renderer process can exploit this flaw by using a specially crafted HTML page to bypass the Same Origin Policy (SOP). This bypass allows the attacker to perform unauthorized cross-origin actions or access data that should be restricted to other domains. The issue is resolved in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome version 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE published to NVD.