Executive brief
A security vulnerability in Google Chrome could allow a malicious website to bypass the browser's Same Origin Policy, which is the primary security mechanism that prevents websites from accessing each other's data. If an attacker has already compromised a specific internal browser process, they could use this flaw to steal sensitive information like login sessions or personal data from other websites you have open. This issue has been resolved in the latest version of Chrome.
Technical details
A policy enforcement vulnerability exists in the Web Workers component of Google Chrome. The flaw allows a remote attacker who has already achieved code execution within a compromised renderer process to bypass the Same Origin Policy (SOP). By enticing a user to visit a specially crafted HTML page, the attacker can leverage insufficient validation in Workers to access data across different origins. This vulnerability is tracked as CVE-2026-11197 and was addressed in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome version 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE-2026-11197 published.