Description

Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-06T22:16:55.813Z",
  "pubdate": "2026-08-06T22:16:55.813Z",
  "executiveSummary": "A critical heap buffer overflow vulnerability exists within the CrashReporting component of Google Chrome prior to version 151.0.7922.109. This security flaw enables a remote attacker who has already successfully compromised the renderer process to potentially achieve a sandbox escape through the ingestion of a maliciously crafted HTML page. The vulnerability presents a severe risk to client-side security architecture by weakening the boundary isolation provided by the browser sandbox. Exploitation requires the victim to render untrusted web content via the vulnerable browser instance. Successful execution allows malicious code to break out of the constrained renderer environment, potentially leading to unauthorized system access or arbitrary code execution with elevated privileges on the underlying host system.",
  "technicalDetails": "The vulnerability resides in the CrashReporting subsystem of Google Chrome, specifically involving memory management practices when handling crash data or reporting routines. The root cause is a heap buffer overflow, occurring when data written to a dynamically allocated heap region exceeds the allocated buffer boundaries due to insufficient bounds checking or incorrect size calculations. In the context of the browser architecture, the renderer process operates within a restricted security sandbox designed to mitigate the impact of remote code execution flaws. An attacker leveraging this vulnerability typically begins by achieving initial execution within the renderer process via memory corruption or logic flaws triggered by a crafted HTML page containing malicious scripts or markup. Once the renderer process is compromised, the attacker interacts with the CrashReporting component, supplying manipulated inputs designed to overflow the vulnerable heap buffer. This memory corruption permits the rewriting of adjacent heap metadata, function pointers, or critical object structures. By carefully controlling the overflow payload, the attacker can hijack the control flow of the execution context, subverting the security guarantees enforced by the browser sandbox. This enables the transition of execution context from the low-privilege renderer process to a higher-privilege browser process or the underlying operating system environment. Affected software versions include all Google Chrome releases prior to 151.0.7922.109. The attack vector is network-based in the context of web browsing, requiring the rendering of untrusted content, and does not require prior authentication beyond the user navigating to the attacker-controlled or compromised web page."
}