Google Chrome (versions below 149.0.7827.102)

The V8 engine failed to properly restrict where it could read and write in memory. When a user visits a specially crafted HTML page, the engine processes it in a way that allows an attacker to corrupt the memory heap (the region where the browser stores data while running), which can expose sensitive information or crash the process in a way the attacker controls.

An attacker hosts a malicious web page. The target visits it — no download, no click beyond navigation. Chrome processes the page's JavaScript, triggering the out-of-bounds operation. This gives the attacker the ability to execute arbitrary code (run their own instructions) inside Chrome's sandbox (the isolated environment Chrome uses to contain web content). Further steps would be required to break out of the sandbox entirely, but initial code execution is achievable through the browser alone.

Watch for Chrome processes crashing unexpectedly or spawning unusual child processes. Endpoint logs showing Chrome making unexpected outbound connections after visiting an unfamiliar site are worth investigating. Users reporting sudden browser crashes on specific sites should be treated as a signal until patched.

1. Open Chrome → three-dot menu → Help → About Google Chrome → let it update to 149.0.7827.102 or later, then relaunch.
2. If you manage a fleet, prioritise Chrome updates across all endpoints before end of day.
3. Consider restricting access to untrusted or uncategorised web destinations until patched.