Executive brief
Google Chrome is a widely used web browser. A security vulnerability in the browser's networking component could allow a remote attacker who has already partially compromised the browser to bypass security boundaries known as the Same Origin Policy. This could lead to unauthorized access to data from other websites or services the user is currently logged into.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Network component of Google Chrome. The flaw allows a remote attacker who has already achieved code execution within a compromised renderer process to bypass the Same Origin Policy (SOP). By enticing a user to visit a specially crafted HTML page, the attacker can leverage this insufficient validation to access data across security origins. This vulnerability is fixed in Chrome version 149.0.7827.53 for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel
- 2026-06-04: disclosed: CVE published to NVD dataset