Executive brief
Google Chrome for Windows contains a security vulnerability in its Settings component. If a user visits a specially crafted malicious website, an attacker who has already partially compromised the browser's internal processes could bypass security restrictions (the 'sandbox') that normally keep the browser isolated from the rest of the computer. This could allow the attacker to gain broader access to the underlying Windows operating system.
Technical details
A vulnerability classified as Improper Input Validation (CWE-20) exists in the Settings component of Google Chrome for Windows. The flaw stems from insufficient validation of untrusted input, which can be exploited by a remote attacker who has already achieved code execution within a compromised renderer process. By enticing a user to visit a malicious HTML page, the attacker can leverage this weakness to perform a sandbox escape, moving from the restricted renderer environment to the higher-privileged browser process or the host operating system. This vulnerability is addressed in Chrome version 150.0.7871.47 and later.
Affected products
- Google Chrome Prior to 150.0.7871.47
Timeline
- 2026-05-15: disclosed: Reported to Chromium by Google researchers
- 2026-06-30: patched: Fixed in stable channel update 150.0.7871.47 for Windows
- 2026-06-30: advisory