Executive brief
Google Chrome is a widely used web browser. A vulnerability in its Blink rendering engine could allow a remote attacker to execute malicious code on a user's computer if they visit a specially crafted website. While the attack is limited by the browser's security sandbox, it could still lead to unauthorized actions within the browser or be used as part of a larger attack chain to compromise the system.
Technical details
An integer overflow vulnerability exists in the Blink rendering engine of Google Chrome prior to version 149.0.7827.53. The flaw is triggered when the browser processes a specially crafted HTML page, leading to memory corruption. A remote, unauthenticated attacker can exploit this by enticing a user to visit a malicious website, potentially achieving arbitrary code execution within the context of the renderer process (sandboxed). The vulnerability is tracked as CWE-472 (External Control of Assumed-Immutable Web Parameter) in some contexts, though the primary root cause is an integer overflow. Users should update to version 149.0.7827.53 or later to mitigate this risk.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE-2026-11171 published.