Executive brief
A vulnerability exists in Google Chrome's V8 engine, which is responsible for processing JavaScript on websites. An attacker could exploit this by tricking a user into visiting a malicious webpage and performing specific interactions, such as clicking or scrolling. If successful, the attacker could execute unauthorized code on the user's computer, potentially leading to data theft or full system compromise within the browser's security boundaries.
Technical details
A use-after-free (UAF) vulnerability exists in the V8 JavaScript engine component of Google Chrome. The flaw is triggered when the engine attempts to access memory that has already been freed, a condition reachable via a specially crafted HTML page. Exploitation requires a remote attacker to convince a user to perform specific UI gestures (user interaction). Successful exploitation allows for arbitrary code execution within the browser's sandbox. The issue is addressed in Google Chrome version 149.0.7827.53 and later.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE-2026-10991 published.