Executive brief
A security vulnerability in Google Chrome's developer tools could allow a malicious website to break out of the browser's security sandbox. This component is typically used by developers to inspect and debug web pages. If exploited, an attacker who has already gained limited control over a browser process could gain full access to the underlying operating system, potentially leading to data theft or the installation of malware.
Technical details
An inappropriate implementation vulnerability exists in the DevTools component of Google Chrome. The flaw stems from improper input validation (CWE-20) which can be leveraged by a remote attacker. To exploit this, an attacker must first compromise the renderer process (e.g., via a separate memory corruption bug) and then entice a user to visit a specially crafted HTML page. Successful exploitation allows the attacker to bypass the Chromium sandbox, achieving code execution with the privileges of the browser process on the host operating system. The issue is resolved in version 149.0.7827.115.
Affected products
- Google Chrome prior to 149.0.7827.115
Timeline
- 2026-05-25: disclosed: Reported by Google internal researchers
- 2026-06-11: patched: Fixed in Stable Channel Update 149.0.7827.114/.115
- 2026-06-11: advisory