Executive brief
Google Chrome is a widely used web browser. A vulnerability in how the browser handles XML files could allow a malicious website to run unauthorized scripts in the context of other websites you have open. This could lead to the theft of sensitive information, such as login tokens or personal data, from those other sites.
Technical details
A Universal Cross-Site Scripting (UXSS) vulnerability exists in Google Chrome's XML implementation prior to version 149.0.7827.53. The flaw stems from an inappropriate implementation that fails to properly isolate script execution when processing specially crafted XML files. A remote attacker can exploit this by enticing a user to visit a malicious webpage or open a malicious XML file. Successful exploitation allows the attacker to bypass the Same-Origin Policy (SOP) and execute arbitrary JavaScript or HTML in the context of any website currently loaded in the browser. This issue is resolved in Chrome version 149.0.7827.53 for Linux and 149.0.7827.53/.54 for Windows and Mac.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE-2026-11169 published.