Executive brief
Google Chrome's Views component on Windows contained an improper initialization vulnerability that could allow an attacker with a compromised renderer process to escape the browser sandbox and execute arbitrary code. An attacker would need to first compromise the renderer through another vulnerability and then use social engineering to trick a user into visiting a malicious HTML page. A successful exploit could give an attacker full control of the system outside the browser sandbox.
Technical details
This is an improper initialization vulnerability in the Views UI framework component of Google Chrome on Windows. The vulnerability requires a renderer process to be compromised first (either through a separate vulnerability or attack), after which an attacker can craft a malicious HTML page leveraging social engineering to trigger improper initialization logic. This allows breaking out of Chrome's sandbox restrictions and executing arbitrary code with system-level privileges. The vulnerability affects Chrome versions prior to 153.0.8010.36, which contains the fix. Chromium rated this as Medium severity, though the overall severity is higher due to the sandbox escape impact.
Affected products
- Google Chrome prior to 153.0.8010.36 on Windows
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched: Chrome 153.0.8010.36 released