Executive brief
Google Chrome is a widely used web browser. A security vulnerability in its V8 JavaScript engine could allow a malicious website to execute unauthorized code on a user's computer within the browser's restricted environment. This could lead to the compromise of browser data or serve as a stepping stone for further attacks on the underlying operating system.
Technical details
A stack-based buffer overflow (CWE-121) exists in the V8 JavaScript engine component of Google Chrome. The vulnerability can be triggered by a remote, unauthenticated attacker who convinces a user to visit a malicious website containing a specially crafted HTML page. Successful exploitation allows for arbitrary code execution within the Chrome renderer process sandbox. The issue was addressed in Chrome version 150.0.7871.182 for Windows and Mac, and 150.0.7871.181 for Linux.
Affected products
- Google Chrome Prior to 150.0.7871.182
Timeline
- 2026-06-10: disclosed: Reported by Google internal researchers
- 2026-07-21: patched: Fixed in stable channel update 150.0.7871.182
- 2026-07-21: advisory