Executive brief
Google Chrome, a widely used web browser, contained a security flaw in its V8 engine, which handles JavaScript. An attacker could exploit this by tricking a user into visiting a malicious website and performing specific interactions, such as clicking or scrolling. If successful, the attacker could execute unauthorized code on the user's device, potentially leading to data theft or full system compromise within the browser's security boundaries.
Technical details
A use-after-free (UAF) vulnerability exists in the V8 JavaScript engine within Google Chrome prior to version 150.0.7871.46. The flaw is triggered when the engine incorrectly manages memory during the execution of JavaScript, specifically when a user is induced to perform certain UI gestures on a malicious page. A remote, unauthenticated attacker can exploit this to achieve arbitrary code execution (ACE) within the Chromium sandbox. The vulnerability is classified as High severity by the Chromium project, and users are advised to update to version 150.0.7871.46 or later to mitigate the risk.
Affected products
- Google Chrome prior to 150.0.7871.46
Timeline
- 2026-06-30: patched: Fix released in Chrome version 150.0.7871.46/47
- 2026-07-01: disclosed: CVE published to NVD