Description

Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T22:16:58.123Z",
  "pubdate": "2026-08-06T22:16:58.123Z",
  "executiveSummary": "A high-severity vulnerability involving a use-after-free condition has been identified within the Views component of Google Chrome on Windows prior to version 151.0.7922.109. This security flaw poses significant risk to end-users by potentially enabling remote heap corruption and arbitrary code execution.\nThe vulnerability resides in the browser's handling of specific user interface elements and memory management within the Views framework. Exploitation of this vulnerability requires a remote attacker to deliver a specially crafted HTML page and successfully convince a targeted user to engage in specific UI gestures, such as interacting with malicious layout components.\nSuccessful exploitation allows the attacker to manipulate freed heap memory, leading to memory corruption and potential application instability or arbitrary code execution within the context of the running browser process. Given the requirement for user interaction via crafted web content, the attack vector is classified as remote via web browsing.\nOrganizations and individual users running vulnerable versions of Google Chrome on Windows are exposed to elevated risk until patches are applied. The primary defense involves upgrading the browser to version 151.0.7922.109 or later, where the underlying memory management defect is addressed.",
  "technicalDetails": "The vulnerability is a classic use-after-free (UAF) memory corruption flaw located in the Views component of Google Chrome on Windows. A use-after-free condition occurs when a program continues to use a pointer after the memory object it references has been deallocated or freed. This typically arises due to complex object lifecycle management, dangling pointers, or incorrect reference counting within graphical user interface abstraction layers.\nIn this specific context, the vulnerable component is responsible for rendering and managing UI elements within the browser window. When a user interacts with the application via specific UI gestures orchestrated by a remote web page, the internal state machine of the Views framework improperly handles object destruction and subsequent references. Specifically, an object is freed while references to it still persist within internal data structures or event handlers.\nThe attack flow begins when a remote attacker hosts a crafted HTML page containing malicious layout definitions, Cascading Style Sheets, or scripted interactions designed to trigger the lifecycle flaw. The attacker lures a victim to navigate to this page using Google Chrome. Once the page is rendered, the attacker induces the user to perform specific UI gestures, such as clicking, dragging, or resizing elements, which interact with the vulnerable Views component.\nDuring these interactions, the application attempts to access the deallocated memory location of the target object. This invalid memory access leads to heap corruption. An attacker who can reliably control the heap layout and reallocate the freed memory chunk with controlled payload data can hijack the execution flow of the browser process. Depending on the success of the heap manipulation, this can result in arbitrary code execution within the security context of the user running the browser process.\nThe affected software comprises Google Chrome on Windows prior to version 151.0.7922.109. The vulnerability does not require prior authentication or elevated privileges on the host operating system, but it does require network exposure via web navigation and active user engagement through specific UI gestures to initiate the vulnerable execution path."
}