Executive brief
A security vulnerability in Google Chrome's Service Worker component could allow a malicious website to bypass standard security boundaries. By tricking a user into visiting a specially crafted webpage, an attacker could potentially access data from other websites that the user has open. This bypasses the Same Origin Policy, which is a fundamental security feature designed to keep different websites' data isolated from one another.
Technical details
A vulnerability classified as Protection Mechanism Failure (CWE-693) exists in the Service Worker implementation of Google Chrome. The flaw results from insufficient policy enforcement, which allows a remote attacker to bypass the Same Origin Policy (SOP). To exploit this, an attacker must entice a user to visit a maliciously crafted HTML page. Successful exploitation enables the attacker to perform unauthorized cross-origin data access. The issue is resolved in Chrome version 148.0.7778.179 for Mac and Windows, and 148.0.7778.178 for Linux.
Affected products
- Google Chrome prior to 148.0.7778.179
Timeline
- 2026-03-25: disclosed: Reported to Chromium project
- 2026-05-19: patched: Stable channel update released
- 2026-05-20: advisory: CVE published