Executive brief
A vulnerability in Google Chrome's MediaCapture component on macOS could allow a malicious website to access data from other websites. This bypasses the browser's security boundaries, potentially leading to the exposure of sensitive user information. Users are advised to update to the latest version of Chrome to mitigate this risk.
Technical details
An inappropriate implementation and insufficient data validation vulnerability exists in the MediaCapture component of Google Chrome on macOS. A remote attacker can exploit this by enticing a user to visit a specially crafted HTML page. Successful exploitation allows the attacker to bypass cross-origin resource sharing (CORS) or similar security boundaries to leak sensitive data from other origins. The vulnerability was addressed in Chrome version 149.0.7827.103 for Mac.
Affected products
- Google Chrome prior to 149.0.7827.103
Timeline
- 2026-05-27: disclosed: Reported to Chromium by Google researchers
- 2026-06-08: patched: Fixed in stable channel update 149.0.7827.103
- 2026-06-09: advisory: NVD publication date