Executive brief
A vulnerability in the Google Chrome web browser could allow a malicious website to bypass Content Security Policy (CSP) protections. CSP is a security layer that helps detect and mitigate certain types of attacks, including data theft and site defacement. By bypassing these rules, an attacker could potentially execute unauthorized scripts or access data they should not have permission to reach.
Technical details
A vulnerability classified as an 'inappropriate implementation' exists within the HTML Parser component of Google Chrome. A remote attacker can exploit this by enticing a user to visit a specially crafted HTML page, which triggers a bypass of the Content Security Policy (CSP). This could allow for the execution of unauthorized scripts or the loading of restricted resources that the CSP was intended to block. The issue is resolved in Google Chrome version 151.0.7922.72 for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: patched: Fixed in Chrome Stable channel update 151.0.7922.72
- 2026-07-30: disclosed: NVD publication date