Executive brief
A vulnerability exists in the Google Chrome address bar (Omnibox) that could allow a malicious website to corrupt the browser's memory. To trigger this, an attacker must trick a user into visiting a specifically crafted webpage and performing certain mouse or keyboard actions. If successful, this could lead to browser crashes or potentially allow the attacker to execute unauthorized code on the user's system.
Technical details
This is a use-after-free (UAF) vulnerability located in the Omnibox (address bar) component of Google Chrome. The flaw is triggered when the browser attempts to access memory that has already been freed, typically due to improper state management during specific user interface interactions. A remote attacker can exploit this by hosting a malicious HTML page and inducing the user to perform specific UI gestures, leading to heap corruption. This corruption can be leveraged to cause a denial-of-service (browser crash) or potentially achieve arbitrary code execution within the context of the browser process. The issue is resolved in Google Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Fixed in Chrome 149.0.7827.53 stable channel update.
- 2026-06-04: disclosed: CVE published in NVD.