Executive brief
Google Chrome is a widely used web browser. A vulnerability in its internal user interface (WebUI) could allow a malicious website to access sensitive data from other websites if the browser's security boundaries have already been partially compromised. This could lead to the exposure of private user information or session data.
Technical details
An improper input validation vulnerability (CWE-20) exists in the WebUI component of Google Chrome. The flaw allows a remote attacker to bypass cross-origin isolation. To exploit this, an attacker must first achieve code execution within a compromised renderer process. Once the renderer is compromised, the attacker can use a specially crafted HTML page to trigger the vulnerability in WebUI and leak data across origins. This issue was addressed in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE-2026-11105 published.