Executive brief
Google Chrome is a widely used web browser. A vulnerability in its V8 JavaScript engine could allow a malicious website to access sensitive information stored in the browser's memory. This could lead to the exposure of private data from other open tabs or internal browser processes if a user visits a specially crafted webpage.
Technical details
A type confusion vulnerability (CWE-843) exists within the V8 JavaScript engine component of Google Chrome. The flaw is triggered when the engine incorrectly handles objects of incompatible types, allowing for out-of-bounds memory access. A remote attacker can exploit this by enticing a user to visit a maliciously crafted HTML page. Successful exploitation allows the attacker to read sensitive information from the browser's process memory, potentially bypassing security boundaries. The issue is resolved in Chrome version 148.0.7778.168 and later.
Affected products
- Google Chrome prior to 148.0.7778.168
Timeline
- 2026-03-06: disclosed: Reported by Google internal researchers
- 2026-05-12: patched: Fix released in version 148.0.7778.168
- 2026-05-14: advisory: NVD publication date