Executive brief
Google Chrome is a widely used web browser. A security vulnerability in its networking component could allow a remote attacker who has already partially compromised the browser's rendering process to steal sensitive data from other websites. This could lead to the exposure of private user information or login sessions if a user visits a specially crafted malicious webpage.
Technical details
This vulnerability is classified as improper input validation (CWE-20) within the Network component of Google Chrome. The flaw allows an attacker who has already achieved code execution within a compromised renderer process to bypass Same-Origin Policy (SOP) restrictions. By enticing a user to visit a malicious HTML page, the attacker can exploit this insufficient validation to leak sensitive cross-origin data. The issue was addressed in Chrome version 149.0.7827.115 for Windows and Mac, and 149.0.7827.114 for Linux.
Affected products
- Google Chrome Prior to 149.0.7827.115
Timeline
- 2026-05-27: other: Reported to Google by internal researchers.
- 2026-06-11: patched: Fixed in stable channel update 149.0.7827.115.
- 2026-06-11: disclosed: Public advisory published.