Executive brief
Google Chrome, a widely used web browser, was found to have a security vulnerability in its V8 JavaScript engine. An attacker could exploit this by tricking a user into visiting a specially crafted website, potentially allowing the attacker to run unauthorized code on the user's computer. While the impact is limited by the browser's security sandbox, it could still lead to localized data access or further exploitation of the system.
Technical details
This vulnerability is classified as an out-of-bounds (OOB) write (CWE-787) within the V8 JavaScript engine of Google Chrome. The flaw is triggered when the engine processes a specially crafted HTML page, allowing a remote, unauthenticated attacker to write data past the end of an intended buffer. This memory corruption can be leveraged to achieve arbitrary code execution within the context of the Chromium sandbox. The vulnerability was addressed in Chrome version 150.0.7871.46 for Linux and 150.0.7871.46/.47 for Windows and Mac. Google has categorized the severity of this specific issue as Low.
Affected products
- Google Chrome prior to 150.0.7871.46
Timeline
- 2026-06-30: patched: Chrome 150.0.7871.46 released to stable channel.
- 2026-07-01: advisory: NVD published the CVE record.