Description

Heap buffer overflow in Base in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T22:16:57.893Z",
  "pubdate": "2026-08-06T22:16:57.893Z",
  "executiveSummary": "A heap buffer overflow vulnerability exists within the Base component of Google Chrome prior to version 151.0.7922.109.\nThe vulnerability allows an attacker to achieve potential heap corruption through the exploitation of a crafted Chrome Extension.\nSuccessful exploitation of this high-severity flaw can lead to severe security implications, including arbitrary code execution within the context of the browser process.\nThe attack requires user interaction, specifically convincing the target user to install a malicious extension.\nOnce the malicious extension is installed, it can interact with vulnerable internal browser logic to trigger memory corruption conditions.\nThe risk profile is elevated due to the potential for sandbox escape or compromise of underlying host system integrity depending on subsequent exploitation chains.",
  "technicalDetails": "The vulnerability resides in the Base component of Google Chrome, specifically within memory management routines handling data structures parsed from extension packages.\nA heap buffer overflow occurs when an application writes more data to a buffer allocated on the heap than the buffer is capable of holding, resulting in the corruption of adjacent memory chunks, control data, or critical application pointers.\nIn this specific scenario, the vulnerable component processes data supplied by a crafted Chrome Extension installed by the user.\nThe attack flow begins when the user installs the malicious extension, which introduces specially engineered payloads or resource structures into the browser environment.\nWhen the Base component processes these crafted extension assets, it fails to perform adequate bounds checking or size validation prior to copy operations into fixed-size heap buffers.\nThis memory safety violation allows the attacker to overwrite adjacent heap metadata or function pointers.\nAffected software versions include all Google Chrome releases prior to 151.0.7922.109.\nThe attack vector relies on local execution context via the extension model, requiring user interaction to complete the installation phase, but does not inherently require pre-existing authentication or elevated privileges beyond the execution of the browser instance and extension permissions.\nPost-exploitation impact includes application crashes, denial of service, or potential arbitrary code execution within the memory space of the affected process, facilitating further system compromise."
}