Executive brief
Google Chrome, a widely used web browser, was found to have a security flaw in how it handles website styling (CSS). An attacker could exploit this by tricking a user into visiting a specially crafted website, potentially allowing the attacker to read sensitive information from the browser's memory. This could include data from other open tabs or internal browser processes.
Technical details
A type confusion vulnerability (CWE-843) exists in the CSS engine of Google Chrome. The flaw is triggered when the browser incorrectly processes specific CSS structures within a crafted HTML page, leading to an incompatible type access. A remote, unauthenticated attacker can exploit this to read sensitive information from the process memory. The vulnerability is addressed in Google Chrome version 150.0.7871.47 and later. The Chromium project classified this as a Low severity issue.
Affected products
- Google Chrome Prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched