Executive brief
A vulnerability in Google Chrome for Linux could allow a malicious website to access sensitive information from the browser's memory. By tricking a user into visiting a specially crafted webpage, an attacker could potentially read data that they should not have access to, such as fragments of other open tabs or browser processes. This issue has been resolved in the latest version of Chrome.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the Input component of Google Chrome for Linux. The flaw is triggered when the browser processes a specially crafted HTML page, leading to memory access outside of the intended buffer. A remote, unauthenticated attacker can exploit this by hosting a malicious website and inducing a user to visit it. Successful exploitation allows the attacker to read sensitive information from the browser's process memory, potentially leading to information disclosure. The vulnerability is addressed in Google Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel
- 2026-06-04: disclosed: CVE published by NVD