Executive brief
Google Chrome is a widely used web browser. A vulnerability was found in its V8 engine, which is responsible for processing JavaScript on websites. If a user visits a specially crafted malicious website, an attacker could execute unauthorized code within the browser's restricted environment, potentially leading to further exploitation or system compromise.
Technical details
A vulnerability classified as 'Inappropriate Implementation' exists in the V8 JavaScript engine of Google Chrome. The flaw allows a remote, unauthenticated attacker to achieve arbitrary code execution within the browser's sandbox environment. Exploitation requires a user to navigate to a malicious, specially crafted HTML page (User Interaction required). The vulnerability was addressed in Chrome version 147.0.7727.55 for Windows, Mac, and Linux. While the specific root cause is labeled as 'Inappropriate Implementation,' it is categorized under improper access control (CWE-284).
Affected products
- Google Chrome prior to 147.0.7727.55
Timeline
- 2026-02-14: disclosed: Reported by Google internal researchers
- 2026-04-07: patched: Fixed in Chrome 147.0.7727.55 stable channel update
- 2026-04-08: advisory: NVD publication date