Executive brief
A vulnerability in the Google Chrome web browser allowed malicious websites to bypass security boundaries and access data from other websites. By tricking a user into visiting a specially crafted webpage, an attacker could potentially leak sensitive information belonging to other web services the user is logged into. This could lead to unauthorized data exposure and a compromise of user privacy.
Technical details
A vulnerability classified as an 'Inappropriate Implementation' exists within the Network stack of Google Chrome. The flaw allows for the leakage of cross-origin data, effectively bypassing Same-Origin Policy (SOP) protections under specific conditions. An attacker can exploit this by hosting a malicious HTML page and enticing a user to visit it. The vulnerability is triggered when the browser incorrectly handles network requests or responses, allowing the attacker's site to read data from a different origin. This issue was addressed in Google Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE published.