Description

Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-06T22:16:58.690Z",
  "pubdate": "2026-08-06T22:16:58.690Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Media component of Google Chrome on Windows prior to version 151.0.7922.109.\nThe vulnerability allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape through the delivery of a crafted HTML page.\nThe flaw carries a high security severity rating within the Chromium project, reflecting the significant risk associated with security boundary bypasses and potential host system compromise.\nExploitation requires the attacker to successfully compromise the renderer process initially and lure a user into loading a malicious web page containing crafted HTML content that triggers the memory corruption condition.\nSuccessful execution enables attackers to break out of the browser sandbox containment mechanisms, potentially leading to arbitrary code execution outside the restricted renderer context.",
  "technicalDetails": "The root cause of the vulnerability is a use-after-free memory management defect residing within the Media component of Google Chrome on the Windows platform.\nA use-after-free condition occurs when an application continues to use a pointer after the memory region it references has been deallocated, typically resulting in dangling pointers.\nThe affected component handles media processing routines within the browser architecture, specifically impacting versions prior to 151.0.7922.109 on Windows.\nThe attack vector requires a remote attacker to first establish execution within the restricted renderer process, commonly achieved by exploiting a separate initial vulnerability or processing flaw.\nOnce the renderer process is compromised, the attacker introduces a specially crafted HTML page designed to interact with the vulnerable Media component.\nWhen the browser processes the malicious HTML payload, it triggers memory operations that reference the dangling pointer within the Media subsystem.\nBy precisely manipulating the heap layout and exploiting the deterministic reuse of freed memory blocks, the attacker can achieve arbitrary read and write primitives or control flow hijacking.\nThis memory corruption within the renderer process is subsequently leveraged to execute sophisticated privilege escalation techniques, ultimately breaching the Chromium security sandbox boundaries.\nPost-exploitation impact includes the potential execution of arbitrary native code on the underlying Windows operating system outside the confines of the browser sandbox, posing severe risks to host integrity and user confidentiality."
}