Executive brief
A vulnerability exists in Google Chrome's 'Views' component, which handles the browser's user interface elements. If a user visits a specially crafted malicious website, an attacker who has already compromised the browser's rendering process could bypass security restrictions (the 'sandbox') that normally keep web content isolated from the rest of the computer. This could allow the attacker to gain broader access to the underlying operating system.
Technical details
This vulnerability is a Use-After-Free (UAF) class issue (CWE-416) located within the Views component of Google Chrome. The flaw is reachable via a crafted HTML page. A successful exploit requires the attacker to have already compromised the renderer process; from that position, the UAF can be leveraged to achieve a sandbox escape, potentially leading to arbitrary code execution at the privilege level of the browser process. The issue was addressed in Chrome version 151.0.7922.72 for Windows and Mac, and 151.0.7922.71 for Linux.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-05-14: disclosed: Reported to Chromium by Google researchers
- 2026-07-29: patched: Fixed in stable channel update 151.0.7922.72
- 2026-07-30: advisory: NVD publication date