Executive brief
Google Chrome is a widely used web browser. A vulnerability in the address bar (Omnibox) could allow a malicious website to trick a user into performing specific actions that result in the execution of unauthorized scripts. This could lead to the theft of sensitive information or unauthorized actions on other websites the user has open.
Technical details
A Universal Cross-Site Scripting (UXSS) vulnerability exists in the Omnibox component of Google Chrome due to improper input validation (CWE-20). A remote attacker can exploit this by hosting a specially crafted HTML page and convincing a user to perform specific UI gestures. Successful exploitation allows the attacker to inject and execute arbitrary scripts or HTML in the context of other websites, bypassing the Same-Origin Policy. The vulnerability is addressed in version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel
- 2026-06-05: disclosed: CVE published to NVD