Executive brief
Google Chrome is a widely used web browser. A vulnerability in its WebSocket implementation could allow a malicious website to bypass the Same-Origin Policy, which is a fundamental security mechanism that prevents websites from interfering with each other. This could potentially allow an attacker to perform unauthorized actions or manipulate data on other sites the user is visiting.
Technical details
A vulnerability exists in Google Chrome's WebSocket implementation due to insufficient validation of untrusted input. An attacker who has already achieved code execution within a compromised renderer process can exploit this flaw to bypass the Same-Origin Policy (SOP). The attack is typically delivered via a specially crafted HTML page that requires user interaction (visiting the page). Successful exploitation allows the attacker to circumvent security boundaries between different web origins. The issue is addressed in Chrome version 147.0.7727.55.
Affected products
- Google Chrome prior to 147.0.7727.55
Timeline
- 2026-04-07: patched: Chrome 147.0.7727.55 released to stable channel.
- 2026-04-08: disclosed: NVD publication date.