Executive brief
A vulnerability exists in Google Chrome's Web Neural Network (WebNN) component, which is used to enable machine learning capabilities directly in the browser. A remote attacker could exploit this flaw by tricking a user into visiting a specially crafted website, potentially allowing the attacker to read sensitive information from the browser's memory. This could lead to the exposure of private data handled by the browser process.
Technical details
An integer overflow vulnerability exists in the WebNN (Web Neural Network) API implementation within Google Chrome. The flaw is triggered when processing specific inputs via a crafted HTML page, leading to an out-of-bounds memory access. A remote, unauthenticated attacker can exploit this to leak sensitive information from the browser's process memory. The vulnerability is classified by Chromium as Low severity and is addressed in version 150.0.7871.47 and later. The issue is tracked as CWE-472 (External Control of Assumed-Immutable Web Parameter) by some sources, though the primary mechanism is an integer overflow.
Affected products
- Google Chrome Prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched
- 2026-06-30: advisory