Executive brief
A critical security vulnerability has been identified in Google Chrome for macOS within the password management component. An attacker could exploit this flaw by tricking a user into visiting a malicious website and performing specific mouse or keyboard actions. If successful, this could allow the attacker to corrupt the browser's memory, potentially leading to the theft of sensitive information or the ability to run unauthorized code on the user's computer.
Technical details
A use-after-free (UAF) vulnerability exists in the Passwords component of Google Chrome for macOS. The flaw is triggered when a user is convinced to engage in specific UI gestures while visiting a specially crafted HTML page. This memory corruption issue (CWE-416) can lead to heap corruption, which may be leveraged by a remote attacker to achieve arbitrary code execution within the context of the browser process. The vulnerability was reported by Google internal researchers and is addressed in Chrome version 149.0.7827.53/54.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-05-26: disclosed: Reported by Google researchers
- 2026-06-02: patched: Fixed in stable channel update 149.0.7827.53/54
- 2026-06-04: advisory