Executive brief
A vulnerability in Google Chrome's V8 engine could allow a remote attacker to execute malicious code on a user's computer. This occurs when a user visits a specially crafted website designed to exploit a memory error in the browser. While the attack is initially confined to the browser's security sandbox, it represents a significant step toward a full system compromise or data theft.
Technical details
An out-of-bounds (OOB) write vulnerability (CWE-787) exists in the V8 JavaScript engine component of Google Chrome. The flaw is triggered when the engine improperly handles memory during the processing of JavaScript, allowing an attacker to write data past the end of an allocated buffer. By enticing a user to visit a malicious website, a remote attacker can exploit this to achieve arbitrary code execution (ACE) within the renderer process sandbox. The vulnerability was addressed in Chrome version 148.0.7778.216 and later.
Affected products
- Google Chrome Prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Stable channel update released for Windows, Mac, and Linux.
- 2026-05-28: disclosed: CVE record published.