Executive brief
A vulnerability exists in Google Chrome's V8 engine, which is responsible for processing JavaScript. An attacker could exploit this by tricking a user into visiting a specially crafted website, potentially allowing the attacker to execute unauthorized code on the user's computer. While the attack is limited by Chrome's security sandbox, it could still lead to data exposure or serve as a stepping stone for further system compromise.
Technical details
A use-after-free (UAF) vulnerability exists in the V8 JavaScript engine component of Google Chrome. The flaw is triggered when the engine incorrectly manages memory lifecycle, allowing a remote attacker to exploit a 'dangling pointer' after the memory has been freed. By enticing a user to load a maliciously crafted HTML page, an attacker can achieve remote code execution (RCE) within the context of the Chromium renderer sandbox. The vulnerability was addressed in Google Chrome version 151.0.7922.72.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: patched: Fixed in Chrome Stable channel update 151.0.7922.72
- 2026-07-30: disclosed: NVD publication date