Executive brief
Google Chrome's V8 JavaScript engine contains a use-after-free vulnerability that allows remote attackers to execute arbitrary code within the browser's sandbox by visiting a specially crafted webpage. An attacker could potentially break out of the sandbox or gain control of the browser process, compromising user data and system security.
Technical details
This is a use-after-free memory safety vulnerability in the V8 JavaScript engine used by Google Chrome. The vulnerability allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. No special privileges or user authentication is required—visiting a malicious webpage is sufficient for exploitation. The vulnerability was patched in Chrome version 153.0.8010.47 and later. The attack vector is network-based and requires user interaction (visiting a website), but the impact is high as it enables arbitrary code execution within the browser sandbox.
Affected products
- Google Chrome prior to 153.0.8010.47
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: fixed in version 153.0.8010.47