Executive brief
A vulnerability in Google Chrome's V8 engine could allow a malicious browser extension to execute unauthorized code. To exploit this, an attacker must first trick a user into installing a specifically crafted malicious extension. While the impact is limited to the browser's security sandbox, it represents a failure in the browser's ability to isolate extension activities from the underlying system.
Technical details
This vulnerability is classified as an 'inappropriate implementation' within the V8 JavaScript engine of Google Chrome. The flaw allows a malicious Chrome Extension to bypass intended execution boundaries and execute arbitrary code within the browser's sandbox environment. The attack vector requires user interaction, specifically the installation of a malicious extension. The issue was addressed in Chrome version 151.0.7922.72. Chromium developers have rated this as Low severity because the execution is still confined within the sandbox.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-30: advisory
- 2026-07-29: patched