Executive brief
Google Chrome contains a vulnerability in its DevTools component, which is a set of web developer tools built directly into the browser. An attacker could exploit this flaw by tricking a user into visiting a specially crafted website, potentially allowing the attacker to execute malicious code on the user's computer. While the code execution is restricted within a security 'sandbox,' it still poses a significant risk to user data and browser security.
Technical details
An integer overflow vulnerability exists in the DevTools component of Google Chrome prior to version 149.0.7827.53. The flaw is triggered when the browser processes a specially crafted HTML page, leading to memory corruption. A remote, unauthenticated attacker can exploit this by enticing a user to visit a malicious website, resulting in arbitrary code execution within the browser's sandboxed environment. This vulnerability is classified by Chromium as High severity and is tracked as CWE-472 (External Control of Assumed-Immutable Web Parameter). Users are advised to update to version 149.0.7827.53 or later to mitigate this risk.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel
- 2026-06-04: disclosed: CVE published by NVD