Executive brief
Google Chrome is a widely used web browser. A security flaw in its networking component could allow a remote attacker to bypass security boundaries and access sensitive data from other websites. This typically requires the attacker to first compromise a specific internal browser process and then trick a user into visiting a malicious webpage, potentially leading to the theft of personal information or login sessions.
Technical details
An insufficient policy enforcement vulnerability exists in the Network stack of Google Chrome. The flaw allows a remote attacker to leak cross-origin data, bypassing Same-Origin Policy (SOP) protections. To exploit this, an attacker must first achieve code execution in a compromised utility process. Once the process is compromised, the attacker can use a specially crafted HTML page to extract data from other origins. This vulnerability is fixed in Google Chrome version 149.0.7827.103 for Windows and Mac, and 149.0.7827.102 for Linux.
Affected products
- Google Chrome prior to 149.0.7827.103
Timeline
- 2026-05-27: other: Reported by Google researchers
- 2026-06-08: patched: Stable channel update released
- 2026-06-09: disclosed: NVD publication date