Executive brief
Google Chrome is a widely used web browser. A vulnerability in its V8 engine allows a remote attacker to execute malicious code on a user's computer if they visit a specially crafted website. While the attack is contained within the browser's security sandbox, it could lead to data theft or further system compromise if combined with other flaws.
Technical details
An out-of-bounds (OOB) read and write vulnerability exists in the V8 JavaScript engine within Google Chrome. The flaw is triggered when the engine processes a specially crafted HTML page, allowing a remote attacker to achieve arbitrary code execution within the browser's sandbox environment. This is a memory corruption issue where the engine fails to properly validate the boundaries of memory buffers during JavaScript execution. Users are advised to update to version 150.0.7871.128 or later to mitigate this risk.
Affected products
- Google Chrome prior to 150.0.7871.128
Timeline
- 2026-07-06: other: Reported by OpenAI Codex Security (amyb)
- 2026-07-16: patched: Fixed in version 150.0.7871.128/.129
- 2026-07-20: advisory: NVD publication date