Executive brief
Google Chrome is a widely used web browser. A security vulnerability in the browser's download component could allow a remote attacker to execute malicious code on a user's computer if the user visits a specially crafted website. This could lead to full system compromise, unauthorized data access, or the installation of malware.
Technical details
A remote code execution vulnerability exists in the Downloads component of Google Chrome due to improper input validation (CWE-20). The flaw allows a remote attacker to execute arbitrary code by tricking a user into visiting a maliciously crafted HTML page. The vulnerability is triggered by insufficient validation of untrusted input during download operations. This issue was addressed in Chrome version 148.0.7778.168 for Windows, Mac, and Linux. While the specific root cause is restricted in Chromium issue trackers, it is classified with High severity and requires user interaction (visiting a site) to exploit.
Affected products
- Google Chrome Prior to 148.0.7778.168
Timeline
- 2026-02-23: disclosed: Reported by rachmat.abdul.ro
- 2026-05-12: patched: Fixed in Stable Channel Update 148.0.7778.167/168
- 2026-05-14: advisory: NVD publication date