Executive brief
Google Chrome, a widely used web browser, contained a security flaw in its HTML implementation. This vulnerability could allow a malicious website to bypass Content Security Policy (CSP) protections, which are designed to prevent unauthorized scripts from running. If exploited, an attacker could potentially execute unauthorized actions or access sensitive data within the context of other websites visited by the user.
Technical details
A vulnerability classified as an inappropriate implementation in the HTML component of Google Chrome allowed for a Content Security Policy (CSP) bypass. By enticing a user to visit a specially crafted HTML page, a remote attacker could circumvent security headers intended to restrict resource loading and script execution. This issue was identified in Chromium issue 513791232 and is rated as High severity by the vendor. The vulnerability is resolved in Google Chrome version 151.0.7922.72 for Windows and Mac, and 151.0.7922.71 for Linux.
Affected products
- Google Chrome Prior to 151.0.7922.72
Timeline
- 2026-05-16: disclosed: Reported to Google
- 2026-07-29: patched: Fixed in Stable Channel Update 151.0.7922.72
- 2026-07-30: advisory: NVD publication date