Executive brief
A vulnerability in Google Chrome's Serial API allows a remote attacker to execute malicious scripts or display unauthorized content on any website the user visits. This occurs when a user visits a specially crafted webpage, potentially leading to the theft of sensitive information or unauthorized actions performed on behalf of the user across different web sessions. This type of attack, known as Universal Cross-Site Scripting (UXSS), bypasses the standard security boundaries that keep websites isolated from one another.
Technical details
A Universal Cross-Site Scripting (UXSS) vulnerability exists in the Serial API component of Google Chrome. The flaw stems from an inappropriate implementation that fails to maintain proper isolation between origins when handling serial port interactions. A remote, unauthenticated attacker can exploit this by enticing a user to visit a maliciously crafted website. Successful exploitation allows the attacker to execute arbitrary JavaScript or inject HTML into any open tab or web origin, bypassing the Same-Origin Policy (SOP). This vulnerability is addressed in Chrome version 149.0.7827.155.
Affected products
- Google Chrome prior to 149.0.7827.155
Timeline
- 2026-05-28: disclosed: Reported to Chrome by Google researchers
- 2026-06-16: patched: Fixed in Stable Channel Update 149.0.7827.155/.156
- 2026-06-17: advisory: NVD publication date