Executive brief
A security vulnerability exists in the Google Chrome web browser's storage component. If a user visits a specially crafted malicious website, an attacker who has already partially compromised the browser's internal processes could bypass security boundaries (the sandbox) that normally keep web content isolated. This could allow the attacker to gain broader access to the underlying system beyond what a web browser should typically be able to reach.
Technical details
A heap-based buffer overflow (CWE-122) exists in the Storage component of Google Chrome due to insufficient data validation. The vulnerability is reachable via a crafted HTML page. A successful exploit requires the attacker to have already achieved code execution within a compromised renderer process. Once this precondition is met, the attacker can leverage this flaw to perform a sandbox escape, potentially gaining elevated privileges on the host system. The issue is resolved in Google Chrome version 150.0.7871.47 and later.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: advisory: Google released the stable channel update fixing the issue.
- 2026-06-30: patched