Executive brief
Google Chrome is a widely used web browser. A security vulnerability has been identified in its V8 engine, which is responsible for processing JavaScript. If a user visits a specially crafted malicious website, an attacker could potentially execute unauthorized code on the user's computer, although this action would be restricted by the browser's security sandbox.
Technical details
A use-after-free (UAF) vulnerability exists in the V8 JavaScript engine component of Google Chrome. The flaw is triggered when the engine attempts to access memory that has already been freed, typically during the processing of a specifically crafted HTML page or JavaScript execution. A remote, unauthenticated attacker can exploit this by enticing a user to visit a malicious website, leading to arbitrary code execution within the context of the browser's sandbox. This vulnerability was addressed in Chrome version 151.0.7922.72 for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-05-08: disclosed: Reported to Chromium by Google researchers
- 2026-07-29: patched: Fixed in Stable Channel Update 151.0.7922.72
- 2026-07-30: advisory: NVD publication date