Executive brief
A vulnerability exists in Google Chrome's V8 engine, which is responsible for processing JavaScript. If a user is tricked into installing a malicious browser extension, an attacker could execute unauthorized code within the browser's restricted environment (sandbox). While the impact is limited to the sandbox, it represents a failure in the browser's security boundaries.
Technical details
A use-after-free (UAF) vulnerability (CWE-416) exists in the V8 JavaScript engine component of Google Chrome. The flaw is reachable via a crafted Chrome Extension. An attacker who successfully convinces a user to install a malicious extension can exploit this memory corruption issue to achieve arbitrary code execution within the renderer sandbox. Google has addressed this in version 151.0.7922.72. The vulnerability is classified by Chromium as Low severity, likely due to the requirement for extension installation and the sandbox restriction.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: patched: Fixed in Chrome Stable channel update 151.0.7922.72
- 2026-07-30: disclosed: NVD publication date