Executive brief
A vulnerability in Google Chrome's CSS implementation could allow a malicious website to bypass security boundaries. By tricking a user into visiting a specially crafted webpage, an attacker could inject unauthorized scripts or HTML into other websites the user is visiting. This could lead to the theft of sensitive information, such as login credentials or personal data, through a technique known as Universal Cross-Site Scripting (UXSS).
Technical details
A Universal Cross-Site Scripting (UXSS) vulnerability exists in Google Chrome's CSS engine due to an inappropriate implementation. The flaw allows a remote attacker to bypass the Same-Origin Policy (SOP) by enticing a user to visit a malicious HTML page. Successful exploitation enables the attacker to execute arbitrary JavaScript or inject HTML in the context of any website currently open in the browser. This vulnerability was addressed in Chrome version 149.0.7827.53 for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome version 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE-2026-11186 published.