Description

Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T22:16:58.920Z",
  "pubdate": "2026-08-06T22:16:58.920Z",
  "executiveSummary": "A use-after-free vulnerability exists within the Extensions component of Google Chrome prior to version 151.0.7922.109.\nThe vulnerability allows a malicious actor to achieve arbitrary code execution inside a restricted sandbox environment.\nExploitation requires user interaction, specifically convincing a target user to install a crafted malicious Chrome Extension.\nSuccessful exploitation compromises the integrity and security boundary of the browser extension runtime, presenting a high severity risk to affected systems.\nThe flaw impacts browser security architecture by enabling memory corruption scenarios through improper heap management within extension handling routines.",
  "technicalDetails": "The root cause of the vulnerability is a use-after-free (UAF) condition within the Extensions component of Google Chrome.\nA use-after-free flaw occurs when memory is freed but the application retains a pointer to that memory location, leading to potential pointer reuse and memory corruption.\nThe affected component is the Extensions subsystem, specifically prior to version 151.0.7922.109.\nExploitation requires local execution vectors contingent upon user interaction, specifically requiring an attacker to successfully convince a user to install a crafted Chrome Extension.\nThe attack flow proceeds as follows: First, the attacker develops a crafted Chrome Extension containing payloads designed to trigger memory mismanagement in the vulnerable Extensions component. Second, the user is deceived into installing this malicious extension into their browser instance. Third, upon execution or interaction within the browser, the extension triggers the use-after-free condition by referencing dangling pointers within the heap. Fourth, memory manipulation via heap spraying or precise heap feng-shui allows the attacker to control the freed memory contents.\nBy manipulating the newly allocated contents of the previously freed memory block, the attacker achieves arbitrary code execution.\nCode execution occurs inside a sandbox, limiting direct host-level access, but successfully compromises the security boundaries enforced within the Chrome Extension execution context.\nThe vulnerability requires no prior authentication within the application context, but demands execution privileges associated with extension installation and a local attack vector mediated by social engineering."
}