Executive brief
Google Chrome is a widely used web browser. A vulnerability in how the browser handles HTML content could allow a remote attacker to execute unauthorized code on a user's computer if they visit a specially crafted website. While the exploit is limited by the browser's security sandbox, it could still lead to unauthorized actions or be used as part of a larger attack to compromise the system or user data.
Technical details
A use-after-free (UAF) vulnerability exists in the HTML engine of Google Chrome. The flaw is triggered when the browser incorrectly manages memory lifecycle for HTML elements, allowing a remote attacker to provide a specially crafted HTML page that references memory after it has been freed. This can lead to arbitrary code execution (ACE) within the context of the Chromium renderer sandbox. The attack requires no special privileges other than enticing a user to visit a malicious URL. Google has addressed this in version 150.0.7871.47 and later.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched
- 2026-06-30: advisory