Executive brief
A vulnerability in Google Chrome for Android's Tab Group Sync feature could allow a remote attacker to execute malicious scripts. This occurs when the browser processes specially crafted network traffic, potentially leading to the unauthorized access of user data or the hijacking of web sessions. Users are advised to update to the latest version of Chrome to mitigate this risk.
Technical details
A Universal Cross-Site Scripting (UXSS) vulnerability exists in the Tab Group Sync component of Google Chrome for Android. The flaw stems from improper input validation (CWE-20) of data received over the network during tab synchronization. A remote attacker can exploit this by delivering malicious network traffic that, when processed by the browser, injects arbitrary HTML or JavaScript into the context of other web pages. This bypasses the Same-Origin Policy (SOP), allowing the attacker to interact with or steal data from any open site. The issue is resolved in version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149 stable channel update released.
- 2026-06-04: disclosed: CVE published to NVD.