Description

Use after free in Resources in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-06T22:16:56.160Z",
  "pubdate": "2026-08-06T22:16:56.160Z",
  "executiveSummary": "A use-after-free vulnerability resides in the Resources component of Google Chrome on Android prior to version 151.0.7922.109.\nThe vulnerability allows a remote attacker who has already compromised the renderer process to potentially achieve a sandbox escape via a crafted HTML page.\nThe flaw carries a Chromium security severity rating of High, posing significant risk to device integrity if successfully exploited.\nAttack capabilities require the attacker to compromise the renderer process initially, typically by enticing a user to navigate to a malicious web page containing crafted HTML content.\nSuccessful exploitation compromises the security boundary enforced by the browser sandbox, potentially granting the attacker elevated privileges on the underlying Android system.",
  "technicalDetails": "The root cause of the vulnerability is a use-after-free memory corruption flaw within the Resources component of Google Chrome on Android.\nA use-after-free condition occurs when memory is reallocated or freed while a pointer to that memory remains active, allowing an attacker to manipulate dangling pointers.\nThe affected product is Google Chrome on Android, specifically targeting versions prior to 151.0.7922.109.\nThe attack vector involves a remote attacker delivering a crafted HTML page to a target user operating the vulnerable browser instance.\nPrerequisites for exploitation dictate that the attacker must first successfully compromise the renderer process, which operates within the restricted context of the browser sandbox.\nUpon successful compromise of the renderer process, the crafted HTML payload leverages the use-after-free vulnerability in the Resources component to execute arbitrary memory manipulation.\nThis memory manipulation facilitates a sandbox escape, allowing the attacker to break out of the constrained renderer process and elevate their operational context.\nNo authentication is required by the attacker beyond the capability to deliver network-based web content that the victim processes within the browser.\nThe post-exploitation impact includes the potential breach of system-level defenses, unauthorized access to device resources, and execution of code outside the restricted confines of the Chromium sandbox architecture."
}