Executive brief
Google Chrome is a widely used web browser. A vulnerability in the browser's Extensions component could allow a remote attacker who has already partially compromised the browser to bypass security boundaries known as 'site isolation.' This could lead to the unauthorized access of data from other websites or the user's local system, undermining the core privacy protections of the browser.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Extensions component of Google Chrome. The flaw allows a remote attacker who has already compromised the renderer process to bypass Site Isolation protections by utilizing a specially crafted HTML page. Site Isolation is a security feature that ensures pages from different websites are run in separate processes to prevent data leakage. By bypassing this, an attacker could potentially access sensitive information across different origins. The vulnerability was addressed in Google Chrome version 149.0.7827.103.
Affected products
- Google Chrome prior to 149.0.7827.103
Timeline
- 2026-05-15: disclosed: Reported to Google by internal researchers
- 2026-06-08: patched: Fixed in Stable Channel Update 149.0.7827.102/.103
- 2026-06-09: advisory: NVD publication date