Executive brief
A vulnerability in Google Chrome's font processing component could allow a remote attacker to access sensitive information. By tricking a user into visiting a specially crafted website, an attacker could read data from the browser's memory that they should not have access to. This could potentially expose private user data or information from other open tabs.
Technical details
An integer overflow vulnerability exists in the Fonts component of Google Chrome prior to version 149.0.7827.53. The flaw is categorized as an out-of-bounds read (CWE-125) triggered when processing font data. A remote attacker can exploit this by hosting a malicious HTML page; when a victim visits the page, the browser may leak sensitive information from its process memory to the attacker. This vulnerability is rated as Low severity by Chromium. Users are advised to update to version 149.0.7827.53 or later to mitigate the risk.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel
- 2026-06-05: disclosed: CVE published in NVD