Executive brief
Google Chrome is a web browser used by billions of people to access websites and online services. A use-after-free memory vulnerability in Chrome's DOM (Document Object Model) handling allows an attacker to execute malicious code within the browser's security sandbox by tricking users into visiting a crafted HTML page. If exploited, an attacker could potentially compromise user data, inject malware, or hijack browser sessions.
Technical details
A use-after-free vulnerability exists in the DOM (Document Object Model) component of Google Chrome prior to version 151.0.7922.173. The vulnerability is triggered when a crafted HTML page is loaded in the browser, causing the renderer process to access memory that has already been freed. The attack vector is network-based (requiring only that a user visit a malicious website) and requires no special authentication or user interaction beyond visiting the page. An attacker can achieve arbitrary code execution within the Chrome sandbox. The vulnerability was patched in Chrome 151.0.7922.173/.174 (Windows/Mac) and 151.0.7922.173 (Linux), released on August 20, 2026.
Affected products
- Google Chrome prior to 151.0.7922.173
Timeline
- 2026-08-20: disclosed
- 2026-08-20: patched