Executive brief
A vulnerability in Google Chrome's network component allowed remote attackers to bypass Content Security Policy (CSP) protections. CSP is a security layer that helps detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. By tricking a user into visiting a specially crafted webpage, an attacker could circumvent these security rules, potentially leading to unauthorized actions or data access within the browser session.
Technical details
This vulnerability is classified as insufficient policy enforcement within the Network stack of Google Chrome. The flaw allowed a remote attacker to bypass Content Security Policy (CSP) directives, which are intended to restrict the resources (such as JavaScript, CSS, Images) that a browser is allowed to load for a given page. The attack is triggered when a user navigates to a malicious, specially crafted HTML page. Successful exploitation allows the attacker to circumvent security headers that would otherwise prevent unauthorized script execution or resource loading. The issue was addressed in Google Chrome version 150.0.7871.47.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched