Executive brief
Google Chrome, a widely used web browser, contained a security flaw in its handling of CSS (Cascading Style Sheets). An attacker could exploit this by tricking a user into visiting a specially crafted website, potentially allowing the attacker to access sensitive information from other websites the user has open. This type of data leak can compromise user privacy and expose personal information across different web services.
Technical details
A vulnerability exists in the CSS implementation of Google Chrome due to an inappropriate implementation that fails to strictly enforce cross-origin boundaries. A remote attacker can exploit this by hosting a malicious HTML page that, when rendered by a victim's browser, uses crafted CSS to exfiltrate data from a different origin (cross-origin data leak). This is classified as a low-severity information disclosure issue. The vulnerability is addressed in Google Chrome version 150.0.7871.47 and later.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched