Executive brief
A vulnerability in Google Chrome's V8 JavaScript engine could allow a remote attacker to execute unauthorized code within the browser's security sandbox. This occurs when a user visits a specially crafted website. While the sandbox limits the attacker's ability to access the underlying operating system, it could still lead to the compromise of data within the browser session.
Technical details
This vulnerability is classified as an 'Inappropriate implementation' within the V8 JavaScript engine, the component responsible for executing scripts in Google Chrome. A remote, unauthenticated attacker can exploit this flaw by enticing a user to visit a maliciously crafted HTML page. Successful exploitation allows for arbitrary code execution (ACE) within the context of the browser's renderer process sandbox. While the sandbox provides a layer of defense-in-depth, this flaw represents a significant step in a multi-stage exploit chain. The issue is resolved in Chrome version 150.0.7871.46 and later.
Affected products
- Google Chrome prior to 150.0.7871.46
Timeline
- 2026-06-30: patched: Chrome 150.0.7871.46 released to stable channel.
- 2026-07-01: disclosed: CVE published in NVD.