Executive brief
A security vulnerability in Google Chrome on Windows could allow a malicious website to bypass the browser's security sandbox. This sandbox is designed to keep web content isolated from the rest of the computer; if bypassed, an attacker who has already compromised the browser's rendering engine could gain broader access to the underlying operating system. Users are protected by updating to the latest version of Chrome.
Technical details
This vulnerability is classified as an 'Inappropriate Implementation' (CWE-20) within the Base component of Google Chrome for Windows. The flaw allows a remote attacker who has already achieved code execution within the renderer process (typically via a separate vulnerability) to escape the Chromium sandbox. By enticing a user to visit a specially crafted HTML page, the attacker can leverage this implementation flaw to gain elevated privileges on the host operating system. The issue is addressed in Google Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel
- 2026-06-04: disclosed: CVE published to NVD