Description

Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-06T22:16:57.777Z",
  "pubdate": "2026-08-06T22:16:57.777Z",
  "executiveSummary": "A use-after-free vulnerability exists within the Payments component of Google Chrome prior to version 151.0.7922.109, presenting a critical security risk to users. This memory corruption flaw allows a remote attacker who has already successfully compromised the renderer process to potentially execute a sandbox escape by leveraging a specially crafted HTML page. The vulnerability impacts the browser architecture by allowing malicious code to break out of restricted execution boundaries, potentially leading to arbitrary code execution on the underlying host operating system. Exploitation requires the attacker to first compromise the rendering engine through auxiliary means, such as a separate remote code execution flaw, and subsequently lure a user into visiting a malicious web page containing the crafted HTML payload. Given the high security severity rating assigned by Chromium, successful exploitation could severely compromise system integrity and user data confidentiality, making timely patching essential to mitigate potential attacks.",
  "technicalDetails": "The vulnerability is rooted in a use-after-free memory management defect residing in the Payments component of Google Chrome prior to version 151.0.7922.109. A use-after-free condition occurs when an application continues to use a pointer after the memory region it references has been deallocated or freed. This typically happens due to complex object lifecycle management issues, race conditions, or improper reference counting within the affected codebase.\nThe attack vector relies on an attacker first achieving arbitrary code execution or control within the restricted context of the renderer process, which handles the parsing and rendering of web content. Once the renderer process is compromised, the attacker delivers a crafted HTML page designed to interact with the vulnerable Payments component. This interaction triggers the improper handling of freed heap memory, allowing the attacker to manipulate dangling pointers.\nThrough precise heap grooming and exploitation techniques, the attacker can repurpose the freed memory chunk to contain malicious payload data or controlled function pointers. When the application subsequently attempts to access the object via the stale pointer, execution flow is redirected to attacker-controlled instructions. By executing code outside the restricted renderer sandbox, the attacker achieves a sandbox escape, elevating their privileges to the security context of the browser process or the user session, ultimately enabling post-exploitation activities such as system compromise."
}