Executive brief
Google Chrome, a widely used web browser, contains a security vulnerability in its password management component. An attacker could exploit this by tricking a user into visiting a specially crafted website, potentially leading to a browser crash or unauthorized memory access. This could impact the stability of the application and the security of user data handled by the browser.
Technical details
A use-after-free (UAF) vulnerability exists in the Passwords component of Google Chrome. The flaw is triggered when the browser incorrectly manages memory during the processing of password-related data, which can be induced by a remote attacker through a specially crafted HTML page. Successful exploitation could lead to heap corruption, potentially allowing for arbitrary code execution within the browser's sandbox or causing a denial-of-service (crash). The vulnerability is tracked as CWE-416 and was addressed in version 150.0.7871.47.
Affected products
- Google Chrome Prior to 150.0.7871.47
Timeline
- 2026-06-30: advisory: NVD and Chrome Release blog published the vulnerability details.
- 2026-06-30: patched: Fixed in Chrome version 150.0.7871.47.