Executive brief
A vulnerability in Google Chrome's V8 engine could allow a remote attacker to execute unauthorized code on a user's computer. This occurs when a user visits a specially crafted, malicious website. While the exploit is contained within the browser's security sandbox, it represents a significant risk to the integrity of the browsing session and could be used as part of a larger attack chain to compromise the underlying system.
Technical details
An integer overflow vulnerability exists in the V8 JavaScript engine component of Google Chrome. The flaw is triggered when the engine processes a specially crafted HTML page, leading to memory corruption. A remote, unauthenticated attacker can exploit this by enticing a user to visit a malicious website, potentially achieving arbitrary code execution within the browser's sandbox environment. The vulnerability is tracked as CWE-472 (External Control of Assumed-Immutable Web Parameter) by Chromium developers. Users should update to Google Chrome version 149.0.7827.53 or later to mitigate this risk.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE published in NVD.