Executive brief
A vulnerability in Google Chrome's plugin component could allow a remote attacker to access sensitive data from other websites. This issue requires the attacker to have already partially compromised the browser's rendering process, typically through a separate exploit. If successful, an attacker could bypass security boundaries to leak user information via a specially crafted webpage.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Plugins component of Google Chrome. The flaw allows a remote attacker to leak cross-origin data, bypassing Same-Origin Policy (SOP) protections. To exploit this, an attacker must first achieve code execution within a compromised renderer process. Once the renderer is compromised, the attacker can use a crafted HTML page to trigger the insufficient validation and exfiltrate data from other origins. The issue is addressed in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-05: disclosed: NVD publication date.