Executive brief
A vulnerability in Google Chrome's CSS engine could allow a remote attacker to execute unauthorized code on a user's computer. By tricking a user into visiting a specially crafted website, an attacker could potentially compromise the browser's security sandbox. While the impact is limited by the browser's internal security boundaries, it represents a significant risk to data privacy and system integrity.
Technical details
A type confusion vulnerability (CWE-843) exists in the Cascading Style Sheets (CSS) processing engine of Google Chrome. The flaw is triggered when the browser incorrectly accesses a resource using an incompatible type during the rendering of a malicious HTML page. A remote, unauthenticated attacker can exploit this by hosting a specially crafted webpage; if a user visits this page, the attacker can achieve arbitrary code execution (ACE) within the context of the browser's sandboxed process. This vulnerability was addressed in Chrome version 149.0.7827.53 for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE published in NVD.