Executive brief
Google Chrome's XML parser contains a type confusion vulnerability that could allow an attacker to execute arbitrary code within the browser sandbox. An attacker can exploit this flaw by crafting a malicious HTML page; when a user visits the page, the vulnerability could be triggered to run attacker-controlled code with the privileges of the Chrome sandbox, potentially compromising user data and system security.
Technical details
A type confusion vulnerability exists in Chrome's XML parsing code, allowing remote code execution within the browser sandbox. The flaw is triggered via a crafted HTML page that causes the XML parser to misinterpret data types during processing. An attacker can exploit this through a network-based attack vector by hosting malicious content or injecting it into legitimate pages; no user authentication or special privileges are required beyond visiting the malicious page. Successful exploitation results in arbitrary code execution constrained by the sandbox, potentially allowing data theft or further system compromise. The vulnerability was fixed in Chrome 153.0.8010.36, released September 8, 2026.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched: Chrome 153.0.8010.36 released