Executive brief
A security vulnerability in Google Chrome's FileSystem component could allow a malicious website to bypass standard security boundaries. If an attacker has already partially compromised the browser's rendering process, they could use a specially crafted webpage to access data from other websites that should normally be protected. This could lead to the unauthorized exposure of sensitive user information or session data.
Technical details
An inappropriate implementation in the FileSystem component of Google Chrome allowed a remote attacker to bypass the Same-Origin Policy (SOP). The vulnerability requires the attacker to have already compromised the renderer process. By enticing a user to visit a crafted HTML page, the attacker can leverage this flaw to access data across origin boundaries. This issue was addressed in Google Chrome version 149.0.7827.53. The vulnerability is classified under CWE-20 (Improper Input Validation).
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Fixed in Chrome Stable channel update 149.0.7827.53
- 2026-06-04: disclosed: NVD publication date