Executive brief
A security vulnerability in Google Chrome on Linux could allow an attacker to impersonate legitimate websites. By intercepting and modifying network traffic, a malicious actor could trick the browser into accepting fraudulent security certificates. This could lead to users unknowingly visiting malicious sites, potentially resulting in the theft of login credentials or sensitive personal information.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Certificate component of Google Chrome on Linux. The flaw stems from insufficient validation of untrusted input during certificate processing. An attacker in a privileged network position (e.g., Man-in-the-Middle) can exploit this by injecting malicious network traffic to perform domain spoofing. This allows the attacker to present a fraudulent certificate that the browser incorrectly validates as legitimate for a target domain. The issue is resolved in Chrome version 150.0.7871.182 and later.
Affected products
- Google Chrome prior to 150.0.7871.182
Timeline
- 2026-07-10: disclosed: Reported to Google internally
- 2026-07-21: patched: Stable channel update released
- 2026-07-21: advisory