Executive brief
A vulnerability in Google Chrome's DevTools on Windows could allow a remote attacker to access sensitive information from the browser's memory. To exploit this, an attacker must trick a user into visiting a malicious website and performing specific interactions or gestures within the browser's interface. While the impact is limited to information disclosure, it could potentially expose data that should remain private during a browsing session.
Technical details
This vulnerability is classified as improper input validation (CWE-20) within the DevTools component of Google Chrome for Windows. The flaw stems from insufficient validation of untrusted input, which can be triggered when a user is persuaded to perform specific UI gestures while interacting with a malicious HTML page. A successful exploit allows a remote attacker to conduct a side-channel or memory disclosure attack to read sensitive information from the browser's process memory. The vulnerability is mitigated by the requirement for specific user interaction (UI gestures). The issue was addressed in Google Chrome version 150.0.7871.47.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched