Description

Use after free in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-06T22:16:57.330Z",
  "pubdate": "2026-08-06T22:16:57.330Z",
  "executiveSummary": "A use-after-free vulnerability exists in the V8 engine component of Google Chrome prior to version 151.0.7922.109. This vulnerability allows a remote, unauthenticated attacker to achieve arbitrary code execution within the browser sandbox context by luring a victim to a specially crafted HTML page. The security severity of this issue is classified as High by Chromium security standards.\nThe flaw stems from improper memory management within V8, where freed heap memory is subsequently accessed or manipulated. Successful exploitation requires the user to load a malicious web page, typically via standard browsing vectors. The primary risk implication is sandbox escape or arbitrary code execution within the restricted sandbox boundaries, potentially leading to compromised browser integrity and further system degradation if chained with additional vulnerabilities.",
  "technicalDetails": "The vulnerability resides in the V8 JavaScript and WebAssembly engine, specifically within memory management routines handling object lifecycles. A use-after-free condition occurs when a dynamic memory allocation is released (freed) while internal references or pointers to the memory address persist. If an attacker can manipulate heap layouts and trigger the reuse of the dangling pointer, they can induce memory corruption.\nExploitation is initiated when a user navigates to a crafted HTML page containing malicious JavaScript or WebAssembly payloads designed to interact with the vulnerable V8 component. The attack flow relies on triggering specific garbage collection timings or execution states that leave a heap object pointer dangling. Subsequent operations on this dangling pointer allow the attacker to read from or write to the freed memory region.\nBy carefully crafting the contents written to the reallocated memory block, the attacker can hijack control flow, manipulate internal V8 engine structures, or corrupt vptrs. This level of manipulation facilitates arbitrary code execution within the confines of the Google Chrome sandbox. The vulnerability requires network exposure via web navigation, no prior authentication, and standard unprivileged user interaction in the form of visiting the malicious URL.\nAffected versions include all Google Chrome releases prior to 151.0.7922.109 utilizing the vulnerable V8 engine build. Post-exploitation impact is constrained by the browser sandbox architecture, but successful execution within the sandbox allows attackers to execute arbitrary code native to the renderer process, potentially serving as a stepping stone for further exploitation chains targeting the underlying operating system."
}