Executive brief
Google Chrome contains a memory corruption vulnerability in its ServiceWorker component that allows remote attackers to execute arbitrary code within the browser sandbox. An attacker can exploit this by distributing a malicious HTML page, potentially compromising users' local data and browser processes without requiring any user credentials or special permissions.
Technical details
This vulnerability is an out-of-bounds write in Chrome's ServiceWorker implementation, classified as a memory corruption flaw. The root cause lies in insufficient bounds checking within the ServiceWorker component, allowing an attacker to write beyond allocated memory. An attacker can trigger the vulnerability by crafting a malicious HTML page and hosting it on a web server, then convincing a user to visit the page—no special authentication or system-level access is required. Successful exploitation enables arbitrary code execution within the browser's sandbox environment, potentially leading to data theft and further system compromise. The vulnerability is fixed in Chrome version 153.0.8010.47 and later.
Affected products
- Google Chrome prior to 153.0.8010.47
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Chrome 153.0.8010.47 or later