Executive brief
Google Chrome is a widely used web browser. A security vulnerability in its graphics processing component could allow a remote attacker to execute malicious code on a user's system if they visit a specially crafted website. This could lead to a total compromise of the user's device, unauthorized data access, or the installation of malware.
Technical details
A vulnerability exists in the GPU component of Google Chrome due to improper memory management, specifically identified as a use-after-free (CWE-416) or out-of-bounds read/write. The flaw can be triggered by a remote attacker who has already compromised the renderer process. By enticing a user to visit a malicious HTML page, the attacker can exploit this memory corruption to escape the browser sandbox and execute arbitrary code with the privileges of the GPU process. This issue was addressed in Google Chrome version 150.0.7871.47.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-05-16: disclosed: Reported to Google by internal researchers
- 2026-06-30: patched: Fixed in version 150.0.7871.47
- 2026-06-30: advisory