Executive brief
A vulnerability in Google Chrome's document processing component could allow a malicious website to execute unauthorized code on a user's computer. By tricking a user into visiting a specially crafted webpage, an attacker could potentially compromise the browser session. While the exploit is limited by the browser's security sandbox, it represents a significant risk to data privacy and system integrity.
Technical details
A use-after-free (UAF) vulnerability exists in the Document Object Model (DOM) implementation of Google Chrome. The flaw is triggered when the browser incorrectly manages memory for DOM objects, allowing a remote attacker to provide a specially crafted HTML page that references memory after it has been freed. Successful exploitation can lead to arbitrary code execution (ACE) within the context of the browser's sandboxed renderer process. The vulnerability affects all desktop platforms (Windows, Mac, and Linux) and was addressed in version 150.0.7871.47.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched
- 2026-06-30: advisory