Executive brief
A vulnerability in Google Chrome's Settings component could allow a remote attacker to gain elevated privileges within the browser. This issue requires the attacker to have already compromised the browser's rendering process, which is the part of the browser that displays web pages. If successful, the attacker could bypass security restrictions to perform actions they would normally be blocked from doing.
Technical details
This vulnerability is classified as insufficient policy enforcement within the Settings component of Google Chrome. The flaw allows a remote attacker to achieve privilege escalation if they have already achieved code execution within a compromised renderer process. By enticing a user to visit a specially crafted HTML page, the attacker can exploit this lack of enforcement to bypass sandbox or policy boundaries. The issue was addressed in Google Chrome version 151.0.7922.72. Google characterizes the severity of this specific issue as Low.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: patched: Fixed in Stable Channel Update 151.0.7922.71/.72
- 2026-07-30: disclosed: NVD publication date