Executive brief
A vulnerability in Google Chrome's Web Share feature could allow a malicious website to access data from other websites. To exploit this, an attacker must trick a user into performing specific interactions or gestures on a specially crafted webpage. This could lead to the unauthorized disclosure of sensitive information that should normally be protected by the browser's security boundaries.
Technical details
A vulnerability classified as 'Inappropriate Implementation' (CWE-20) exists in the Web Share API of Google Chrome prior to version 149.0.7827.53. The flaw allows a remote attacker to bypass cross-origin resource sharing (CORS) protections and leak data from different origins. Successful exploitation requires the attacker to host a malicious HTML page and convince a user to perform specific UI gestures. This interaction triggers the flawed Web Share logic, resulting in the disclosure of sensitive cross-origin information to the attacker's site. The issue is resolved in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel
- 2026-06-04: disclosed: CVE published to NVD