Executive brief
A vulnerability in Google Chrome's rendering engine could allow a malicious website to capture information from other open websites. By tricking a user into visiting a specially crafted webpage, an attacker can use technical side-channels to leak data across security boundaries. This could result in the unauthorized exposure of sensitive user information from different web origins.
Technical details
A side-channel information leakage vulnerability exists in the Paint component of Google Chrome. The flaw, classified under CWE-1300, stems from improper protection of physical side channels during the rendering process. A remote attacker can exploit this by hosting a crafted HTML page; when a user visits this page, the attacker can observe rendering behaviors to infer and leak data from different origins (cross-origin data). This bypasses standard Same-Origin Policy (SOP) protections. The issue is resolved in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-05: disclosed: CVE published.