Executive brief
A security vulnerability exists in the Google Chrome web browser for macOS. This flaw could allow a malicious website to break out of the browser's security sandbox if the attacker has already partially compromised the browser's rendering process. In practice, this could allow an attacker to gain unauthorized access to the underlying operating system or user data beyond what a standard website should be able to reach.
Technical details
A use-after-free (UAF) vulnerability exists in the USB implementation of Google Chrome for macOS. The flaw is located within the handling of USB device interactions, where the browser fails to properly manage memory lifecycles, leading to a 'use-after-free' condition (CWE-416). An attacker who has already achieved code execution within a compromised renderer process can exploit this vulnerability by enticing a user to visit a specially crafted HTML page. Successful exploitation allows the attacker to bypass the Chromium sandbox and execute arbitrary code in the context of the browser process. This issue was addressed in Chrome version 150.0.7871.47.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched
- 2026-06-30: advisory