Executive brief
Google Chrome's developer tools contain a memory safety vulnerability that can be exploited when a user visits a malicious webpage. An attacker can trick a user into opening a crafted HTML page to execute arbitrary code within the browser's sandbox, potentially leading to data theft or further compromise of the user's system.
Technical details
This is a use-after-free vulnerability in the DevTools component of Google Chrome. The flaw allows a remote attacker to trigger code execution in the sandbox through social engineering—specifically by crafting a malicious HTML page that a user must visit. The vulnerability affects Chrome versions prior to 153.0.8010.36. While the Chromium project initially classified this as low severity, the reported CVSS score of 8.8 indicates a high-risk issue. The fix is available in Chrome 153.0.8010.36 and later.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched: Chrome 153.0.8010.36 released