Executive brief
A security vulnerability in Google Chrome's Web Neural Network (WebNN) component could allow a malicious website to bypass the browser's security sandbox. If an attacker has already compromised the part of the browser that displays web pages, they could use this flaw to gain broader access to the underlying Windows operating system. This could lead to unauthorized access to local files or the execution of malicious software on the user's computer.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Web Neural Network (WebNN) API implementation of Google Chrome on Windows. The flaw allows a remote attacker to perform a sandbox escape if they have already achieved code execution within a compromised renderer process. By enticing a user to visit a specially crafted HTML page, the attacker can exploit the insufficient validation of untrusted input to break out of the browser's restricted environment and execute commands with the privileges of the browser process on the host OS. This issue is fixed in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE published in NVD.