Executive brief
A vulnerability in Google Chrome's V8 engine could allow a remote attacker to access sensitive information from the browser's memory. This occurs when a user visits a specially crafted website, potentially leading to the exposure of private data from other open tabs or browser processes. Users should update to version 149.0.7827.53 or later to mitigate this risk.
Technical details
This vulnerability is classified as an out-of-bounds read (CWE-125) within the V8 JavaScript engine, the component responsible for executing code in Google Chrome. The flaw is triggered when the engine attempts to read data outside the intended buffer boundaries while processing a malicious HTML page. A remote, unauthenticated attacker can exploit this by enticing a user to visit a specially crafted website. Successful exploitation allows the attacker to read sensitive information residing in the browser's process memory, which could include session tokens or other private data. The issue was addressed in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome stable channel update released
- 2026-06-04: disclosed: CVE published to NVD