Executive brief
A vulnerability in Google Chrome's MHTML handling could allow a malicious browser extension to access data from other websites. To exploit this, an attacker would need to trick a user into installing a specifically crafted extension. This could result in the unauthorized disclosure of sensitive information from different web origins.
Technical details
A race condition (CWE-362) exists in the MHTML processing logic of Google Chrome prior to version 147.0.7727.138. An attacker can exploit this by convincing a user to install a malicious Chrome Extension designed to trigger the race condition. Successful exploitation allows the extension to bypass cross-origin isolation and leak data from other origins. The attack requires user interaction (UI:R) and has high complexity (AC:H) due to the nature of the race condition. Google has addressed this issue in the stable channel update for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 147.0.7727.138
Timeline
- 2026-04-02: disclosed: Reported to Google by internal team
- 2026-04-28: patched: Fixed in Chrome version 147.0.7727.138
- 2026-04-28: advisory