Executive brief
Google Chrome is a widely used web browser. A security flaw in the browser's core components could allow a malicious website to bypass the browser's security 'sandbox,' which is designed to keep web content isolated from the rest of your computer. If exploited, this could allow an attacker to gain unauthorized access to your system or data after a user visits a specially crafted webpage.
Technical details
A use-after-free (UAF) vulnerability exists in the Browser process of Google Chrome. The flaw is triggered when the browser incorrectly manages memory during certain operations, allowing a remote attacker to exploit the memory corruption. To successfully exploit this, an attacker must first compromise the renderer process (typically via a separate vulnerability) and then entice a user to visit a malicious HTML page. Successful exploitation allows for a sandbox escape, potentially leading to arbitrary code execution on the underlying operating system. The issue is resolved in version 149.0.7827.155 and later.
Affected products
- Google Chrome prior to 149.0.7827.155
Timeline
- 2026-06-03: disclosed: Reported to Google by internal researchers.
- 2026-06-16: patched: Stable channel update released.
- 2026-06-17: advisory: NVD entry published.