Executive brief
Google Chrome's V8 JavaScript engine contains a use-after-free memory vulnerability that could allow an attacker with a compromised renderer process to read memory within the browser sandbox. An attacker would need to trick a user into visiting a malicious webpage to exploit this flaw, potentially exposing sensitive information processed by the browser.
Technical details
A use-after-free vulnerability exists in the V8 JavaScript engine within Google Chrome prior to version 153.0.8010.36. The vulnerability requires the renderer process to be already compromised, and exploitation is triggered via a crafted HTML page that the user visits. Upon successful exploitation, an attacker can read memory contents within the renderer sandbox. The fix is available in Chrome 153.0.8010.36 and later releases.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched: Chrome 153.0.8010.36 released