Executive brief
A vulnerability in Google Chrome on Windows could allow an attacker to gain elevated control over a user's operating system. By tricking a user into visiting a specially crafted website, an attacker who has already compromised the browser's internal rendering process can bypass security boundaries to execute commands with higher privileges. This could lead to full system compromise, unauthorized data access, or the installation of malicious software.
Technical details
An integer overflow vulnerability exists in the CredentialProvider component of Google Chrome for Windows. The flaw is triggered when a remote attacker, who has already achieved code execution within the sandboxed renderer process, lures a user to a malicious HTML page. By exploiting this overflow, the attacker can break out of the browser sandbox and perform OS-level privilege escalation. This vulnerability was addressed in Chrome version 149.0.7827.53. The issue is tracked as CWE-472 (External Control of Assumed-Immutable Web Parameter) by the vendor, though the primary root cause is described as an integer overflow.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome version 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE-2026-11058 published.