Description

Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-06T22:16:56.887Z",
  "pubdate": "2026-08-06T22:16:56.887Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Aura component of Google Chrome on Linux prior to version 151.0.7922.109.\nThe vulnerability allows a remote attacker who has already compromised the renderer process to potentially execute a sandbox escape through a specially crafted HTML page.\nThe Chromium security severity for this issue is classified as High, reflecting its potential to bypass critical security boundaries and impact the underlying host operating system.\nSuccessful exploitation requires the attacker to first achieve compromise of the renderer process, typically by enticing a user to visit a malicious website hosting the crafted HTML payload.\nThe primary risk implication is the elevation of privileges from the restricted renderer sandbox to the broader system context, potentially leading to arbitrary code execution outside the browser sandbox.",
  "technicalDetails": "The root cause of the vulnerability is a use-after-free memory management flaw within the Aura UI framework utilized by Google Chrome on Linux.\nA use-after-free condition occurs when memory is referenced after it has been deallocated, leading to undefined behavior, potential memory corruption, and control flow hijacking opportunities.\nThe vulnerable component is the Aura windowing and UI subsystem within the browser architecture, specifically handling object lifecycles improperly during specific DOM or rendering interactions.\nAffected versions include Google Chrome on Linux prior to version 151.0.7922.109.\nThe attack vector involves a remote attacker delivering a crafted HTML page to a target user.\nThe exploitation prerequisites dictate that the attacker must first compromise the renderer process, which serves as the initial entry point through untrusted web content execution.\nOnce the renderer process is compromised, the attacker triggers the use-after-free condition within the Aura component via targeted manipulations exposed through the crafted HTML page.\nStep-by-step attack flow: First, the user navigates to a malicious URL serving the crafted HTML page. Second, execution of the malicious content achieves a compromise of the renderer process. Third, the compromised renderer exploits the use-after-free vulnerability residing in the Aura subsystem. Finally, the memory corruption facilitates a sandbox escape, granting the attacker unauthorized capabilities outside the isolated renderer environment.\nNetwork exposure is present via standard web browsing vectors, requiring user interaction to load the malicious webpage.\nPost-exploitation impact involves breaking the browser sandbox isolation boundaries, which significantly increases the risk profile of the system by exposing host resources to the attacker."
}