Executive brief
A vulnerability in Google Chrome's V8 JavaScript engine could allow a remote attacker to execute arbitrary code within the browser's security sandbox. This occurs when a user visits a specially crafted website. While the sandbox provides a layer of protection, such flaws are often used as a starting point for more complex attacks to compromise user data or the underlying operating system.
Technical details
This vulnerability is classified as an 'Inappropriate implementation' within the V8 JavaScript engine, the component responsible for executing JavaScript in Google Chrome. A remote attacker can exploit this flaw by enticing a user to visit a malicious or compromised website containing a crafted HTML page. Successful exploitation allows for arbitrary code execution within the context of the browser's renderer process sandbox. The issue was reported by an external researcher and has been addressed in Chrome version 149.0.7827.53 for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-04-27: other: Reported to Chromium project
- 2026-06-02: patched: Fixed in stable channel update 149.0.7827.53
- 2026-06-04: disclosed: CVE published