Executive brief
Google Chrome, a widely used web browser, was found to have a security flaw in how it handles certain website content. An attacker could exploit this by tricking a user into visiting a specially crafted webpage, allowing the attacker to run unauthorized scripts in the context of other websites the user has open. This could lead to the theft of sensitive information, such as login credentials or personal data, from those other sites.
Technical details
A Universal Cross-Site Scripting (UXSS) vulnerability exists in Google Chrome due to improper input validation of untrusted HTML content. By leveraging a crafted HTML page, a remote attacker can bypass the Same-Origin Policy (SOP) to execute arbitrary scripts or inject HTML into the context of other web origins. The vulnerability is classified under CWE-20 (Improper Input Validation). The issue was addressed in Google Chrome version 150.0.7871.47 for Windows, Mac, and Linux. Exploitation requires the victim to navigate to a malicious URL.
Affected products
- Google Chrome Prior to 150.0.7871.47
Timeline
- 2026-06-30: advisory: Google released the stable channel update addressing the issue.
- 2026-06-30: disclosed: NVD published the CVE record.