Executive brief
A security vulnerability in Google Chrome for Android could allow a malicious website to bypass security restrictions. By tricking a user into visiting a specially crafted webpage, an attacker can circumvent the Content Security Policy (CSP), which is a security layer designed to prevent certain types of attacks like data theft or unauthorized script execution. This could lead to unauthorized actions being performed on the user's behalf within the browser.
Technical details
A vulnerability exists in the Navigation component of Google Chrome for Android due to insufficient policy enforcement. A remote attacker can exploit this by hosting a specially crafted HTML page and inducing a user to visit it. Successful exploitation allows the attacker to bypass the Content Security Policy (CSP), a critical security mechanism used to restrict the resources (such as JavaScript, CSS, Images) that the browser is allowed to load for a given page. This bypass can be used to execute unauthorized scripts or exfiltrate data in contexts where CSP should have prevented such actions. The issue is resolved in version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149 promoted to stable channel
- 2026-06-04: disclosed: CVE published to NVD