Executive brief
Google Chrome is a web browser used by billions of users to access websites and web applications. An out of bounds memory read vulnerability in Chrome's V8 JavaScript engine allows attackers to execute arbitrary code within the browser sandbox by tricking users into visiting a specially crafted webpage. This could lead to data theft, malware installation, or compromise of the user's system.
Technical details
An out of bounds read vulnerability exists in V8, Google Chrome's JavaScript engine, prior to version 151.0.7922.72. The vulnerability allows a remote attacker to read memory outside the intended bounds of a buffer, potentially leaking sensitive information or enabling further exploitation. The attack is triggered through a crafted HTML page that must be viewed by the user (requires user interaction). While the vulnerability is limited to execution within the Chrome sandbox, it could potentially be chained with other vulnerabilities for full system compromise. A fix was released in Chrome 151.0.7922.72 on July 29, 2026.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: disclosed: Fixed in Chrome 151.0.7922.72
- 2026-08-28: advisory: Publicly disclosed via NVD