Executive brief
A vulnerability in Google Chrome's V8 engine could allow a malicious browser extension to access sensitive information from the browser's memory. To exploit this, an attacker must first trick a user into installing a specifically crafted malicious extension. This could lead to the unauthorized disclosure of private data handled by the browser process.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the V8 JavaScript engine component of Google Chrome. The flaw is reachable via a crafted Chrome Extension; an attacker who successfully convinces a user to install such an extension can trigger the memory read. This allows the attacker to bypass memory safety boundaries and obtain potentially sensitive information from the browser's process memory. The issue was addressed in Google Chrome version 150.0.7871.46.
Affected products
- Google Chrome prior to 150.0.7871.46
Timeline
- 2026-06-30: patched: Chrome version 150.0.7871.46 released to stable channel.
- 2026-07-01: disclosed: CVE record published.