Executive brief
A vulnerability in Google Chrome's Password Manager could allow a malicious website to escape the browser's security sandbox. This component is responsible for securely storing and filling user credentials. If exploited, an attacker who has already gained partial control over a browser process could bypass security boundaries to potentially access more sensitive parts of the user's system or data.
Technical details
This vulnerability is classified as improper input validation (CWE-20) within the Password Manager component of Google Chrome. The flaw exists because the browser does not sufficiently validate untrusted input, which can be leveraged by a remote attacker. To exploit this, an attacker must first compromise the renderer process (typically via a separate vulnerability) and then use a specially crafted HTML page to trigger the flaw. Successful exploitation could allow the attacker to perform a sandbox escape, moving from the restricted renderer process to a more privileged context. The issue is resolved in Chrome version 149.0.7827.53 and later.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE-2026-11151 published.