Executive brief
Google Chrome is a widely used web browser. A security flaw in how the browser processes XML data could allow a remote attacker to execute malicious code on a user's computer if they visit a specially crafted website. While the attack is limited by the browser's security sandbox, it could still lead to unauthorized actions or be combined with other flaws to compromise the entire system.
Technical details
An integer overflow vulnerability exists in the XML processing component of Google Chrome versions prior to 148.0.7778.168. The flaw is triggered when the browser parses a specially crafted HTML page containing malicious XML content. A remote, unauthenticated attacker can exploit this by enticing a user to visit a malicious website, leading to arbitrary code execution within the context of the Chromium sandbox. This vulnerability is tracked as CWE-472 (External Control of Assumed-Immutable Web Parameter) by some sources, though the primary root cause is an integer overflow. Google has released a patch in version 148.0.7778.168 to address this issue.
Affected products
- Google Chrome Prior to 148.0.7778.168
Timeline
- 2026-03-14: disclosed: Reported by Google internal researchers
- 2026-05-12: patched: Fixed in Chrome Stable Channel Update 148.0.7778.168
- 2026-05-14: advisory: NVD publication date