Executive brief
Google Chrome, a widely used web browser, contains a security vulnerability in its Back/Forward Cache (BFCache) mechanism. This component is responsible for speeding up navigation by saving the state of pages as users move back and forth. If exploited, a remote attacker who has already gained a foothold in the browser's rendering process could bypass security boundaries (the sandbox) to gain broader access to the underlying system.
Technical details
This vulnerability is classified as an improper input validation issue (CWE-20) within the BFCache (Back/Forward Cache) component of Google Chrome. The flaw allows a remote attacker who has already achieved code execution within a compromised renderer process to bypass the browser's sandbox environment. By providing specially crafted HTML content that interacts with the BFCache, the attacker can trigger insufficient validation logic to escape the restricted process. This issue was addressed in Google Chrome version 151.0.7922.72 for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: patched: Fixed in version 151.0.7922.72
- 2026-07-30: disclosed: NVD publication date