Executive brief
A vulnerability in Google Chrome's password management component could allow a malicious website to access data from other websites. This occurs because the browser does not strictly enforce security boundaries when handling certain web pages. An attacker could use this to leak sensitive information, though the risk is categorized as low by the manufacturer.
Technical details
This vulnerability is classified as an insufficient policy enforcement flaw within the Passwords component of Google Chrome. The root cause involves a failure to strictly maintain cross-origin isolation, which can be triggered when a user visits a specially crafted HTML page controlled by an attacker. By exploiting this weakness, a remote attacker can bypass security boundaries to leak data across origins. The issue was addressed in Chrome version 150.0.7871.47 for Windows, Mac, and Linux. Google has assigned this a 'Low' severity rating.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched
- 2026-06-30: advisory