Executive brief
Google Chrome, a widely used web browser, contained a critical security vulnerability in its graphics processing unit (GPU) component. An attacker who has already partially compromised the browser could use this flaw to break out of the security 'sandbox' that normally isolates web pages from the rest of the computer. If successful, this could allow the attacker to gain broader access to the underlying operating system and user data.
Technical details
A use-after-free (UAF) vulnerability exists in the GPU component of Google Chrome prior to version 150.0.7871.47. The flaw is classified under CWE-416 and occurs when the application continues to use a pointer after it has been freed, leading to memory corruption. An attacker who has already achieved code execution within a compromised renderer process can leverage this vulnerability to bypass sandbox restrictions (sandbox escape) by enticing a user to visit a specially crafted HTML page. This vulnerability was reported by Google and is addressed in the stable channel update for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-05-10: disclosed: Reported by Google internal researchers
- 2026-06-30: patched: Fixed in version 150.0.7871.47
- 2026-06-30: advisory