Executive brief
Google Chrome, a widely used web browser, contained a vulnerability in its QUIC networking protocol implementation. A remote attacker could exploit this flaw by sending specially crafted network traffic to a user's browser. If successful, this could lead to memory corruption, potentially allowing the attacker to crash the browser or execute unauthorized code on the user's system.
Technical details
This vulnerability is a use-after-free (CWE-416) within the QUIC protocol stack of the Chromium engine. The flaw is triggered by processing malicious network traffic, which leads to heap corruption. An attacker can leverage this to achieve remote code execution or a denial-of-service (browser crash) within the context of the browser process. The vulnerability was reported by Google internally and is addressed in Chrome version 150.0.7871.47 and later. Access to specific bug details remains restricted to prevent widespread exploitation until more users have updated.
Affected products
- Google Chrome Prior to 150.0.7871.47
Timeline
- 2026-04-03: disclosed: Reported by Google internally
- 2026-06-30: patched: Fixed in Chrome version 150.0.7871.47
- 2026-06-30: advisory