Executive brief
Google Chrome is a widely used web browser. A vulnerability in how the browser handles CSS (Cascading Style Sheets) could allow a malicious website to trick the browser into leaking information from other websites the user is currently visiting. This could result in the unauthorized exposure of sensitive user data across different web domains.
Technical details
A cross-origin data leak vulnerability exists in Google Chrome's CSS implementation. The flaw stems from an inappropriate implementation that fails to strictly enforce cross-origin boundaries when processing certain CSS rules or properties. A remote attacker can exploit this by hosting a specially crafted HTML page; when a user visits this page, the attacker can extract information from other origins (websites) loaded in the browser. This is a side-channel or information disclosure attack that bypasses the Same-Origin Policy (SOP). The issue is resolved in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel
- 2026-06-04: disclosed: CVE published in NVD dataset