Executive brief
Google Chrome is a widely used web browser. A vulnerability in its V8 JavaScript engine allows a remote attacker to execute malicious code on a user's computer if they visit a specially crafted website. While the attack is contained within the browser's security sandbox, it could lead to data theft or further system compromise if combined with other vulnerabilities.
Technical details
An integer overflow vulnerability exists in the V8 JavaScript engine component of Google Chrome. The flaw is triggered when the engine processes a specially crafted HTML page, leading to memory corruption. A remote, unauthenticated attacker can exploit this by enticing a user to visit a malicious website, potentially achieving arbitrary code execution within the context of the browser's sandbox. Google has addressed this issue in Chrome version 148.0.7778.216 and later.
Affected products
- Google Chrome prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Fixed in Chrome version 148.0.7778.216/217
- 2026-05-28: disclosed: CVE published by NVD