Executive brief
Google Chrome is a widely used web browser. A security flaw in how the browser handles web forms could allow a malicious website to execute unauthorized code on a user's computer. While the browser's security sandbox would limit the immediate reach of such an attack, it represents a significant risk to user data and system integrity if combined with other vulnerabilities.
Technical details
A vulnerability classified as an 'inappropriate implementation' exists in the Forms component of Google Chrome. By enticing a user to visit a malicious website containing a crafted HTML page, a remote attacker can trigger this flaw to achieve arbitrary code execution (ACE) within the renderer process sandbox. The issue was reported by Google internal researchers and is addressed in version 150.0.7871.115 for Windows and Mac, and 150.0.7871.114 for Linux. Access to specific bug details remains restricted to prevent further exploitation until a majority of users have updated.
Affected products
- Google Chrome prior to 150.0.7871.115
Timeline
- 2026-06-14: disclosed: Reported by Google internal researchers
- 2026-07-08: patched: Stable channel update released for desktop
- 2026-07-08: advisory: NVD publication date