Executive brief
A vulnerability in Google Chrome's 'Views' component, which handles the browser's user interface elements, could allow a malicious website to corrupt the browser's memory. If a user visits a specially crafted webpage, an attacker could potentially crash the browser or execute unauthorized code on the user's computer. This risk is primarily present for users running Chrome on Windows.
Technical details
A use-after-free (UAF) vulnerability exists in the Views component of Google Chrome for Windows. The flaw is triggered when the browser incorrectly manages memory for UI elements, allowing a remote attacker to induce heap corruption by enticing a user to visit a specifically crafted HTML page. This can lead to an out-of-bounds memory access, potentially resulting in arbitrary code execution within the browser's sandbox or a denial-of-service (browser crash). The issue was resolved in version 149.0.7827.115.
Affected products
- Google Chrome prior to 149.0.7827.115
Timeline
- 2026-06-05: other: Reported to Google
- 2026-06-11: patched: Fixed in stable channel update 149.0.7827.115
- 2026-06-11: disclosed