Executive brief
Google Chrome contains a race condition in its V8 JavaScript engine that allows attackers to execute arbitrary code within the browser's sandbox by hosting a malicious web page. An attacker could use this to compromise the browser process, potentially leading to data theft or further system exploitation.
Technical details
A race condition exists in the V8 JavaScript engine in Google Chrome prior to version 151.0.7922.173. The vulnerability allows remote code execution within the sandbox through a crafted HTML page. The attack requires only network reachability and no user interaction beyond visiting a malicious website. An attacker can trigger the race condition to execute arbitrary code, though execution remains constrained to the browser sandbox. The vulnerability was patched in Chrome 151.0.7922.173 released on August 20, 2026.
Affected products
- Google Chrome prior to 151.0.7922.173
Timeline
- 2026-08-20: disclosed: Patched in Chrome 151.0.7922.173
- 2026-08-03: other: Originally reported by Salvatore Gulizia