Executive brief
Google Chrome is a widely used web browser. A security vulnerability in its 'Blink' rendering engine could allow a malicious website to execute unauthorized code on a user's computer. While the browser's security sandbox limits the immediate impact, this could be used as part of a larger attack to compromise user data or system integrity.
Technical details
A use-after-free (UAF) vulnerability exists in the Blink rendering engine of Google Chrome prior to version 149.0.7827.197. The flaw is triggered when the browser incorrectly manages memory during the processing of specifically crafted HTML content. A remote, unauthenticated attacker can exploit this by enticing a user to visit a malicious website, leading to arbitrary code execution (ACE) within the context of the browser's sandbox. This vulnerability was reported by Google internal researchers and is addressed in the stable channel update for Windows, Mac, and Linux.
Affected products
- Google Chrome < 149.0.7827.197
Timeline
- 2026-06-12: disclosed: Reported by Google internal researchers
- 2026-06-23: patched: Fixed in version 149.0.7827.196/197
- 2026-06-24: advisory