Executive brief
A vulnerability exists in Google Chrome's Web Neural Network (WebNN) component, which is used to run machine learning tasks directly in the browser. By tricking a user into visiting a specially crafted website, an attacker could potentially access sensitive information stored in the browser's memory. This could lead to the exposure of private data from other open tabs or browser processes.
Technical details
An integer overflow vulnerability exists in the WebNN (Web Neural Network) API implementation within Google Chrome. The flaw is triggered when processing malicious input through a crafted HTML page, leading to an out-of-bounds memory access or use of uninitialized variables (CWE-457). A remote, unauthenticated attacker can exploit this to leak sensitive information from the browser's process memory. The vulnerability is addressed in Chrome version 150.0.7871.47 and later. Google classifies this with a 'Low' severity rating.
Affected products
- Google Chrome Prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched