Executive brief
A security vulnerability in Google Chrome's navigation component could allow a remote attacker to access sensitive information from other websites. This issue requires the attacker to have already compromised a specific part of the browser's internal processing (the renderer) and for a user to visit a specially crafted webpage. If exploited, this could lead to the unauthorized disclosure of user data across different web origins.
Technical details
This vulnerability is classified as an inappropriate implementation within the Navigation component of Google Chrome. The root cause involves an origin validation error (CWE-346) that fails to properly isolate data between different web origins during navigation events. To exploit this, an attacker must first achieve code execution within a compromised renderer process. Once the renderer is compromised, the attacker can use a crafted HTML page to bypass cross-origin protections and leak sensitive data from other sites. The vulnerability was addressed in Chrome version 147.0.7727.55.
Affected products
- Google Chrome prior to 147.0.7727.55
Timeline
- 2026-03-05: disclosed: Reported by Google internal researchers
- 2026-04-07: patched: Fixed in Chrome 147.0.7727.55 stable channel update
- 2026-04-08: advisory