Executive brief
A security vulnerability has been identified in Google Chrome's Mojo component, which handles communication between different parts of the browser. An attacker who has already partially compromised the browser could use this flaw to escape the security 'sandbox' that normally isolates web pages from the rest of the computer. If successful, this could allow the attacker to access sensitive files or execute unauthorized commands on the user's operating system.
Technical details
An integer overflow vulnerability exists in Mojo, the inter-process communication (IPC) framework used in Google Chrome. The flaw is triggered when Mojo processes specifically crafted data, potentially leading to memory corruption. An attacker who has already achieved code execution within a sandboxed renderer process can exploit this vulnerability to bypass sandbox restrictions and execute arbitrary code with the privileges of the browser process. This vulnerability is addressed in Chrome version 149.0.7827.201 for Windows and Mac, and 149.0.7827.200 for Linux.
Affected products
- Google Chrome Prior to 149.0.7827.201
Timeline
- 2026-05-14: disclosed: Reported by Google internally
- 2026-06-25: patched: Fixed in stable channel update 149.0.7827.200/201
- 2026-06-25: advisory