Executive brief
Google Chrome is a widely used web browser. A security vulnerability in the way the browser handles user input could allow a remote attacker to bypass security boundaries that normally keep different websites' data separate. This could potentially lead to unauthorized access to information from other open tabs or websites if a user visits a malicious page.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Input component of Google Chrome. The flaw allows a remote attacker who has already compromised the renderer process to bypass the Same Origin Policy (SOP) via a specially crafted HTML page. This requires the victim to interact with the malicious content (User Interaction: Required) and is considered high complexity because it assumes a prior compromise of the renderer process. The vulnerability is addressed in Google Chrome version 149.0.7827.155 for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 149.0.7827.155
Timeline
- 2026-05-25: disclosed: Reported to Google by internal/external researchers
- 2026-06-16: patched: Stable channel update released for desktop
- 2026-06-17: advisory: NVD entry published