Executive brief
Google Chrome, a widely used web browser, contains a critical security vulnerability that could allow an attacker to bypass the browser's security sandbox. If a user visits a specially crafted malicious website, an attacker who has already compromised the browser's rendering process could gain full control over the underlying computer system. This could lead to the theft of sensitive data, installation of malware, or complete disruption of business operations.
Technical details
A use-after-free (UAF) vulnerability exists in the Browser component of Google Chrome prior to version 150.0.7871.47. The flaw is triggered when the browser incorrectly manages memory during the lifecycle of certain objects, allowing an attacker to reference memory after it has been freed. To exploit this, a remote attacker must first compromise the renderer process (e.g., via a separate vulnerability) and then entice a user to visit a malicious HTML page. Successful exploitation enables a sandbox escape, allowing the attacker to execute arbitrary code with the privileges of the browser process on the host operating system. Google has addressed this in the stable channel update to version 150.0.7871.47 and later.
Affected products
- Google Chrome Prior to 150.0.7871.47
Timeline
- 2026-05-26: disclosed: Reported to Google by internal researchers.
- 2026-06-30: patched: Fixed in Chrome version 150.0.7871.47.
- 2026-06-30: advisory: Public advisory published by Google and NVD.