Executive brief
A security vulnerability exists in Google Chrome's FoldableAPIs, which are used to handle web content on devices with foldable screens. If an attacker has already partially compromised the browser's internal rendering process, they could use this flaw to bypass security boundaries that normally prevent one website from accessing data from another. This could lead to unauthorized access to sensitive information or the ability to perform actions on behalf of the user on other websites.
Technical details
A policy enforcement vulnerability exists in the FoldableAPIs component of Google Chrome. The flaw is categorized as improper input validation (CWE-20) and allows a Same-Origin Policy (SOP) bypass. To exploit this, an attacker must first achieve a compromise of the renderer process. Once the renderer is compromised, the attacker can use a specially crafted HTML page to bypass security restrictions and interact with origins they should not have access to. Google has addressed this issue in version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE-2026-11233 published.