Executive brief
A vulnerability exists in Google Chrome, the widely used web browser. An attacker could exploit this flaw by tricking a user into visiting a specially crafted website. If successful, the attacker could execute unauthorized code on the user's computer, though this activity is restricted within the browser's security sandbox.
Technical details
A use-after-free (UAF) vulnerability exists in the DOM component of Google Chrome prior to version 151.0.7922.72. The flaw is triggered when the browser incorrectly manages memory for DOM objects, allowing an attacker to reference memory after it has been freed. By persuading a user to load a malicious HTML page, a remote attacker can exploit this condition to achieve arbitrary code execution (ACE) within the renderer process sandbox. This vulnerability is tracked as CWE-416. Google has released a fix in version 151.0.7922.72 for Windows and Mac, and 151.0.7922.71 for Linux.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-05-28: disclosed: Reported to Chromium project
- 2026-07-29: patched: Fixed in stable channel update 151.0.7922.72
- 2026-07-30: advisory: NVD publication date