Executive brief
Google Chrome is a widely-used web browser that runs code from websites you visit. A type confusion vulnerability in Chrome's Rust-based code could allow an attacker to break out of the browser's security sandbox and run malicious code on a Windows computer. This could lead to complete compromise of the affected system, including theft of credentials and personal data.
Technical details
This vulnerability is a type confusion flaw in Rust code within Google Chrome on Windows. It allows a remote attacker to potentially execute arbitrary code outside the browser's sandbox by crafting a malicious HTML page. The vulnerability requires no authentication and the attack vector is network-based (visiting a malicious website). Type confusion bugs occur when the code mishandles object types, potentially leading to memory safety violations and code execution. A patch is available in Chrome version 153.0.8010.36 and later.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched