Executive brief
A vulnerability exists in Google Chrome's networking component that could allow a malicious website to execute unauthorized code. By tricking a user into visiting a specially crafted webpage, an attacker could potentially compromise the browser's security sandbox. While the impact is limited by the sandbox, this could lead to unauthorized access to browser data or serve as a stepping stone for further system compromise.
Technical details
A use-after-free (CWE-416) vulnerability exists in the Network stack of Google Chrome. The flaw is triggered when the browser incorrectly manages memory for network-related objects, allowing an attacker to reference memory after it has been freed. By enticing a user to visit a malicious HTML page, a remote attacker can exploit this condition to achieve arbitrary code execution within the browser's sandboxed process. The vulnerability was addressed in Chrome version 149.0.7827.103 for Windows/Mac and 149.0.7827.102 for Linux.
Affected products
- Google Chrome prior to 149.0.7827.103
Timeline
- 2026-05-10: disclosed: Reported to Chrome by Google researchers
- 2026-06-08: patched: Fixed in Stable Channel Update 149.0.7827.102/.103
- 2026-06-09: advisory: NVD publication date