Executive brief
A security vulnerability exists in Google Chrome's developer tools that could allow an attacker to bypass the browser's security sandbox. If a user visits a specially crafted website, an attacker who has already gained limited control over the browser's page-rendering process could escalate their access to the underlying operating system. This could lead to unauthorized data access or the execution of malicious software on the user's computer.
Technical details
A use-after-free (UAF) vulnerability exists in the DevTools component of Google Chrome. The flaw is triggered when the browser incorrectly manages memory during the lifecycle of DevTools objects. An attacker who has already achieved code execution within the sandboxed renderer process can exploit this memory corruption to escape the sandbox and execute arbitrary code with the privileges of the browser process. This attack requires the victim to navigate to a malicious HTML page. The vulnerability is addressed in Chrome version 147.0.7727.117 and later.
Affected products
- Google Chrome prior to 147.0.7727.117
Timeline
- 2026-03-18: disclosed: Reported to Chromium project by external researcher
- 2026-04-22: patched: Stable channel update released for Windows, Mac, and Linux
- 2026-04-23: advisory: NVD publication date