Executive brief
A security vulnerability in Google Chrome's extension system could allow a remote attacker to access sensitive information from the browser's memory. This issue requires the attacker to have already compromised a specific part of the browser (the renderer process) and then lure a user to a specially crafted webpage. If successful, this could lead to the exposure of private data handled by the browser or its extensions.
Technical details
This vulnerability is classified as an 'Inappropriate Implementation' within the Extensions component of Google Chrome. The flaw allows a remote attacker to perform an information disclosure attack. To exploit this, an attacker must first achieve code execution within a compromised renderer process. From that position, they can use a specially crafted HTML page to read potentially sensitive information from the browser's process memory. The vulnerability was addressed in Google Chrome version 149.0.7827.53 for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE-2026-11168 published.