Executive brief
A security vulnerability exists in Google Chrome's ANGLE component, which handles graphics processing. If a user visits a specially crafted website, an attacker who has already partially compromised the browser's rendering process could bypass security boundaries to access data from other open websites. This could lead to the unauthorized disclosure of sensitive information across different web domains.
Technical details
A vulnerability classified as an 'inappropriate implementation' exists in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome for Windows. The flaw allows a remote attacker to leak cross-origin data, provided they have already achieved a compromise of the renderer process. By enticing a user to visit a malicious HTML page, the attacker can exploit this implementation flaw to bypass Same-Origin Policy (SOP) protections. The issue was addressed in Chrome version 148.0.7778.168. While the reported CVSS is low, Chromium developers have assigned it a 'High' severity rating.
Affected products
- Google Chrome prior to 148.0.7778.168
Timeline
- 2026-04-06: other: Reported to Google
- 2026-05-12: patched: Fixed in Stable Channel Update 148.0.7778.168
- 2026-05-14: disclosed: CVE published