Executive brief
A vulnerability in Google Chrome's privacy settings could allow a person with control over a local network to intercept data from other websites. This could lead to the unauthorized exposure of sensitive user information while browsing. Users should update to the latest version of Chrome to ensure these privacy protections are properly enforced.
Technical details
An insufficient policy enforcement vulnerability exists in the Privacy component of Google Chrome. A network-positioned attacker (e.g., on a compromised local network or via man-in-the-middle) can exploit this flaw by injecting malicious network traffic to bypass cross-origin data protections. This allows for the leakage of sensitive data across different web origins. The vulnerability is addressed in Chrome version 150.0.7871.47 and later. Google classifies this as a Low severity issue.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched: Fixed in version 150.0.7871.47