Executive brief
Google Chrome, a widely used web browser, contained a security vulnerability in its FileSystem component. An attacker could exploit this by tricking a user into visiting a specially crafted website, potentially allowing the attacker to bypass the browser's security sandbox. If successful, this could lead to unauthorized access to the underlying operating system or user data.
Technical details
A use-after-free (UAF) vulnerability exists in the FileSystem component of Google Chrome. The flaw is triggered when the browser incorrectly manages memory during FileSystem operations, allowing a remote attacker to execute arbitrary code or escape the renderer sandbox via a specifically crafted HTML page. This vulnerability is classified as CWE-416. The issue was addressed in Google Chrome version 149.0.7827.53 for Windows, Mac, and Linux. Exploitation requires the victim to navigate to a malicious URL, but no prior authentication is necessary.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-04-10: disclosed: Reported by researcher asjidkalam
- 2026-06-02: patched: Fixed in version 149.0.7827.53
- 2026-06-04: advisory: NVD publication date