Description

Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-06T22:16:57.113Z",
  "pubdate": "2026-08-06T22:16:57.113Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in the Aura component of Google Chrome on Linux prior to version 151.0.7922.109.\nThis memory corruption flaw allows a remote attacker to potentially achieve a sandbox escape by tricking a victim into rendering a crafted HTML page.\nThe vulnerability represents a severe risk to system integrity and isolation guarantees, as a successful sandbox escape permits malicious code to break out of the browser security boundary and potentially interact with the underlying operating system at a higher privilege level.\nExploitation requires user interaction, specifically navigating the browser to or rendering a maliciously crafted webpage controlled by the attacker.\nNo specialized authentication is required by the attacker beyond the delivery of the malicious HTML content over the network.",
  "technicalDetails": "The root cause of the vulnerability is a use-after-free (UAF) condition within the Aura UI framework component of Google Chrome on Linux.\nA use-after-free vulnerability arises when the application continues to use a pointer after the underlying memory has been deallocated or freed, typically due to improper memory management or lifetime management of dynamic objects.\nIn the context of the Aura component, improper handling of object references during specific UI rendering operations or event handling sequences leaves dangling pointers.\nThe attack flow initiates when a remote attacker delivers a crafted HTML page to a targeted user.\nUpon rendering the malicious HTML page, the browser triggers the execution path containing the flaw in the Aura component.\nThe attacker meticulously crafts the payload to manipulate heap memory layout prior to or during the trigger condition, ensuring that the freed memory chunk is reallocated by a controlled object.\nBy coercing the application into dereferencing the dangling pointer, the attacker achieves arbitrary read/write capabilities or control over execution flow within the context of the affected process.\nBecause the vulnerability impacts core rendering and window management architecture in the browser, exploiting this memory corruption flaw successfully circumvents the security sandbox boundaries established by Google Chrome.\nThis sandbox escape allows the execution of native code outside the restricted browser sandbox environment on the host Linux operating system.\nThe affected software versions include Google Chrome on Linux prior to 151.0.7922.109, and the component involved is Aura.\nThe attack vector is network-based via web content, requires no prior authentication, and relies on user interaction to visit the malicious page."
}