Executive brief
Google Chrome, a widely used web browser, contained a security flaw that could allow an attacker with control over a user's network connection to bypass security restrictions. Specifically, this vulnerability allows malicious network traffic to ignore Content Security Policy (CSP) rules, which are designed to prevent unauthorized scripts and data from loading. If exploited, this could lead to unauthorized actions being performed in the browser or the exposure of sensitive information.
Technical details
A vulnerability classified as an 'inappropriate implementation' existed in the Network stack of Google Chrome prior to version 150.0.7871.47. An attacker in a privileged network position (such as a man-in-the-middle) could craft malicious network traffic to bypass Content Security Policy (CSP) protections. This bypass could allow for the execution of unauthorized scripts or the loading of restricted resources that the browser would otherwise block. The issue was addressed in the stable channel update to version 150.0.7871.47 and later.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: advisory
- 2026-06-30: patched