Executive brief
A security vulnerability exists in Google Chrome's V8 engine, which is responsible for processing JavaScript on websites. By tricking a user into visiting a specially crafted webpage, an attacker could execute malicious code on the user's computer. While the attack is limited to the browser's 'sandbox' (a restricted security environment), it could be used as a starting point for further attacks to compromise the entire system or steal sensitive data.
Technical details
A use-after-free (UAF) vulnerability exists in the V8 JavaScript engine within Google Chrome. The flaw is triggered when the engine attempts to access memory that has already been freed, typically due to improper object lifecycle management during the execution of JavaScript. A remote, unauthenticated attacker can exploit this by hosting a malicious HTML page; when a user visits the page, the attacker can achieve arbitrary code execution (ACE) within the context of the browser's sandboxed process. This vulnerability was addressed in Chrome version 149.0.7827.103 for Windows and Mac, and 149.0.7827.102 for Linux.
Affected products
- Google Chrome prior to 149.0.7827.103
Timeline
- 2026-05-08: disclosed: Reported to Chrome by Google researchers
- 2026-06-08: patched: Stable channel update released
- 2026-06-09: advisory: NVD publication date