Executive brief
Google Chrome is a widely used web browser. A vulnerability in its V8 JavaScript engine allows a malicious website to execute unauthorized code within the browser's security sandbox. This could lead to the compromise of the browser session or be used as a stepping stone for further attacks on the user's computer if combined with other flaws.
Technical details
A vulnerability classified as an 'inappropriate implementation' exists in the V8 JavaScript engine of Google Chrome. The flaw is reachable by a remote, unauthenticated attacker who convinces a user to visit a specially crafted HTML page. Successful exploitation allows the attacker to execute arbitrary code within the context of the browser's renderer process sandbox. While the sandbox limits direct access to the underlying operating system, this execution can be used to access sensitive data within the browser or facilitate a sandbox escape. The issue is resolved in Chrome version 148.0.7778.216 and later.
Affected products
- Google Chrome Prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Stable channel update released for desktop versions.
- 2026-05-28: disclosed: CVE published to the NVD.