Executive brief
A security issue was identified in Google Chrome's Glic component that could allow a malicious website to bypass intended navigation restrictions. By tricking a user into visiting a specially crafted webpage, an attacker could force the browser to navigate to unauthorized locations. This could potentially be used to facilitate further attacks or misdirect users to malicious content.
Technical details
A vulnerability classified as insufficient policy enforcement exists in the Glic component of Google Chrome. The flaw allows a remote attacker to bypass navigation restrictions by utilizing a specially crafted HTML page. The attack vector is network-based and requires user interaction (visiting a malicious site). Successful exploitation allows the attacker to circumvent security policies governing how the browser navigates between pages or contexts. The issue is resolved in Chrome version 150.0.7871.47 and later.
Affected products
- Google Chrome Prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched