Executive brief
Google Chrome, a widely used web browser, contained a security vulnerability in its graphics engine component. An attacker could exploit this by tricking a user into visiting a specially crafted website, potentially allowing the attacker to access sensitive data from other open websites or tabs. This could lead to the exposure of private user information or login credentials.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome. The flaw is triggered when the browser processes a specially crafted HTML page, allowing a remote attacker to read memory outside of the intended buffer. This can be leveraged to bypass cross-origin resource sharing (CORS) protections and leak sensitive data from different origins. The vulnerability affects Google Chrome versions prior to 150.0.7871.46 and has been addressed in the stable channel update.
Affected products
- Google Chrome prior to 150.0.7871.46
Timeline
- 2026-06-30: patched: Fixed in Chrome 150.0.7871.46/.47 stable channel update.
- 2026-07-01: advisory: NVD published the CVE record.