Executive brief
Google Chrome is a widely used web browser. A vulnerability in the browser's tab management component could allow a malicious website to corrupt the browser's memory if a user performs specific interactions. This could potentially lead to the browser crashing or allow an attacker to execute unauthorized code on the user's computer.
Technical details
A use-after-free (UAF) vulnerability exists in the TabStrip component of Google Chrome prior to version 151.0.7922.72. The flaw is triggered when a user is enticed to visit a specially crafted HTML page and perform specific UI gestures, leading to memory corruption in the heap. An attacker could leverage this to achieve remote code execution (RCE) within the context of the browser process. The vulnerability is tracked as CWE-416 and was assigned a 'Medium' severity rating by the Chromium project. Users are advised to update to version 151.0.7922.72 or later to mitigate this risk.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: disclosed: Vulnerability reported in Chrome Stable Channel update blog post.
- 2026-07-29: patched: Fixed in version 151.0.7922.72.
- 2026-07-30: advisory: NVD published CVE-2026-17887.