Executive brief
Google Chrome, a widely used web browser, contained a security vulnerability in its memory management component. An attacker could exploit this by tricking a user into visiting a specially crafted website, potentially allowing the attacker to execute unauthorized code on the user's computer. While the impact is limited by the browser's security sandbox, it could still lead to unauthorized actions or serve as a stepping stone for further attacks.
Technical details
A use-after-free (UAF) vulnerability exists in Oilpan, the C++ garbage collector used by the Blink rendering engine in Google Chrome. The flaw occurs when the browser attempts to access memory that has already been freed, which can be triggered by a remote attacker using a specifically crafted HTML page. Successful exploitation allows for arbitrary code execution (ACE) within the context of the Chrome sandbox. The vulnerability is addressed in Google Chrome version 150.0.7871.47 and later. An attacker would require no special privileges other than the ability to entice a user to visit a malicious URL.
Affected products
- Google Chrome Prior to 150.0.7871.47
Timeline
- 2026-06-30: advisory: NVD publication date
- 2026-06-30: patched: Chrome 150.0.7871.47 released to stable channel