Executive brief
Google Chrome is a widely used web browser. A security flaw in its WebGL component, which handles 3D graphics, could allow a malicious website to bypass security boundaries. This could result in Universal Cross-Site Scripting (UXSS), allowing an attacker to run unauthorized scripts or steal data from other websites you have open.
Technical details
A vulnerability exists in the WebGL implementation of Google Chrome due to an inappropriate implementation of security logic. By enticing a user to visit a specially crafted HTML page, a remote attacker can execute a Universal Cross-Site Scripting (UXSS) attack. This allows the attacker to bypass the Same-Origin Policy (SOP) and execute arbitrary JavaScript or HTML in the context of any website. The issue is resolved in Chrome version 150.0.7871.115 for Windows and Mac, and 150.0.7871.114 for Linux.
Affected products
- Google Chrome prior to 150.0.7871.115
Timeline
- 2026-06-14: disclosed: Reported by Google internal researchers
- 2026-07-08: patched: Stable channel update released
- 2026-07-08: advisory