Executive brief
Google Chrome, a widely-used web browser, contains a use-after-free vulnerability in its Workers component that could allow an attacker to bypass the browser's sandbox security and execute arbitrary code on a user's system. An attacker could exploit this by tricking a user into visiting a specially crafted webpage, potentially leading to complete system compromise, data theft, or malware installation.
Technical details
This is a use-after-free vulnerability in Google Chrome's Workers implementation (CWE-416). The vulnerability exists in Chrome versions prior to 153.0.8010.47 and can be triggered by a crafted HTML page that manipulates Worker objects, leading to memory corruption. The attack vector is network-based and requires user interaction (visiting a malicious webpage); no authentication is required. Successful exploitation allows an attacker to escape the browser sandbox and execute arbitrary code with the privileges of the user running Chrome. The vulnerability has been patched in Chrome 153.0.8010.47 and later.
Affected products
- Google Chrome prior to 153.0.8010.47
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Fixed in Chrome 153.0.8010.47