Description

Use after free in Translate in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-06T22:16:56.653Z",
  "pubdate": "2026-08-06T22:16:56.653Z",
  "executiveSummary": "A use-after-free vulnerability exists within the Translate component of Google Chrome prior to version 151.0.7922.109.\nThis memory corruption flaw allows a remote attacker to execute arbitrary code within the context of the browser sandbox by enticing a user to visit a crafted HTML page.\nCategorized with a high security severity by Chromium, the vulnerability poses significant risk to confidentiality, integrity, and availability of the affected system if successfully exploited.\nThe attack vector is network-based, requiring user interaction to load a malicious webpage containing the exploit payload.\nSuccessful exploitation compromises the renderer or utility process associated with the translation feature, leveraging heap manipulation to achieve arbitrary code execution.",
  "technicalDetails": "The root cause of the vulnerability is a use-after-free condition in the Translate component of Google Chrome, specifically involving improper lifetime management of heap-allocated memory objects.\nA use-after-free vulnerability occurs when a program continues to use a pointer after the memory block it references has been deallocated, often leading to dangling pointers.\nIn the context of this vulnerability, improper handling of object references during translation operations within the affected component leads to a deterministic or exploitable dangling pointer scenario.\nThe attack flow begins when a remote attacker hosts a crafted HTML page designed to trigger the specific translation code path within the browser engine.\nUpon rendering the malicious page, the victim's browser initiates translation operations, causing the vulnerable component to free a specific memory object while retaining a reference to it.\nThe attacker utilizes heap spraying or other memory grooming techniques to reclaim the freed memory block with controlled, malicious data containing fake object vtables or shellcode.\nWhen the program subsequently attempts to access the dangling pointer, it executes attacker-controlled instructions or manipulates program control flow, leading to arbitrary code execution inside the renderer sandbox.\nAffected versions include Google Chrome prior to 151.0.7922.109.\nExploitation requires no prior authentication and no elevated privileges, but does require network exposure via a crafted web page and user interaction to navigate to the malicious site."
}