Executive brief
A vulnerability in the V8 engine of Google Chrome could allow a remote attacker to execute unauthorized code on a user's computer. This occurs when a user visits a specially crafted website, potentially leading to the compromise of the browser's security sandbox. While the impact is limited by the sandbox, it represents a significant risk to data privacy and system integrity if combined with other flaws.
Technical details
A heap buffer overflow vulnerability exists in the V8 JavaScript engine component of Google Chrome. The flaw is triggered when the engine processes a specially crafted HTML page, leading to memory corruption. A remote, unauthenticated attacker can exploit this by enticing a user to visit a malicious website, enabling arbitrary code execution within the context of the browser's sandbox. The vulnerability is also associated with type confusion (CWE-843). Users are advised to update to version 150.0.7871.47 or later to mitigate this risk.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched: Fixed in version 150.0.7871.47