Executive brief
A security vulnerability in Google Chrome's WebAuthentication component could allow a malicious website to bypass standard security boundaries. If an attacker has already partially compromised the browser's rendering process, they could use a specially crafted webpage to access data or perform actions across different websites, violating the Same Origin Policy. This could lead to unauthorized access to user information or sessions on other sites.
Technical details
An improper input validation vulnerability (CWE-20) exists in the WebAuthentication component of Google Chrome. The flaw allows a remote attacker who has already achieved code execution within a compromised renderer process to bypass the Same Origin Policy (SOP). By enticing a user to visit a malicious HTML page, the attacker can leverage this insufficient validation to interact with origins other than the one hosting the malicious content. This vulnerability is mitigated by the requirement of a prior renderer compromise. The issue is resolved in Google Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome Stable Channel Update for Desktop released version 149.0.7827.53
- 2026-06-05: disclosed: NVD publication date