Executive brief
A vulnerability in Google Chrome's password management component could allow a remote attacker to access sensitive information. This issue occurs if an attacker has already partially compromised the browser's rendering process, allowing them to use a specially crafted webpage to extract data from the system's memory. This could lead to the exposure of user credentials or other private information stored during the browsing session.
Technical details
This vulnerability is classified as an 'Inappropriate Implementation' within the Passwords component of Google Chrome. The flaw allows a remote attacker to perform an information disclosure attack. A precondition for this exploit is that the attacker must have already compromised the renderer process (e.g., via a separate sandbox escape or memory corruption bug). Once the renderer is compromised, the attacker can use a crafted HTML page to read sensitive data from the process memory. The issue was addressed in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome Stable Channel Update for Desktop released version 149.0.7827.53
- 2026-06-04: disclosed: CVE published to NVD