Description

Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-06T22:16:59.037Z",
  "pubdate": "2026-08-06T22:16:59.037Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Web Authentication component of Google Chrome prior to version 151.0.7922.109, presenting a severe risk to browser security.\nThis vulnerability allows a remote attacker to potentially achieve a sandbox escape through the ingestion of a maliciously crafted HTML page.\nThe flaw affects the Chromium-based Web Authentication subsystem, which handles cryptographic credentials and security keys.\nSuccessful exploitation compromises the integrity of the browser's privilege boundary, allowing untrusted code executing within the renderer process to break out of the secure sandbox environment.\nThe attacker capabilities include arbitrary code execution outside the restricted renderer sandbox, potentially leading to system-level or operating system-user level compromise depending on subsequent privilege escalation vectors.\nExploitation requirements include enticing a user to navigate to a remote attacker-controlled web page or leveraging an existing injection vector to render malicious HTML containing specific Web Authentication API sequences.",
  "technicalDetails": "The root cause of the vulnerability is a use-after-free (UAF) condition residing within the Web Authentication component of Google Chrome.\nA use-after-free vulnerability occurs when application memory is improperly managed, leaving a dangling pointer after the underlying heap memory has been deallocated or freed.\nIf the program subsequently attempts to dereference this dangling pointer, memory corruption ensues, which can be manipulated to achieve arbitrary code execution.\nThe vulnerable component handles Web Authentication requests, processing credential creation, assertion generation, and hardware token communication.\nAffected versions include Google Chrome builds prior to 151.0.7922.109.\nNetwork exposure is remote, as the attack vector requires the victim to process content from a malicious web page over standard web protocols (HTTP/HTTPS).\nNo prior authentication or specific user privileges are required beyond the standard interaction of visiting a web page and interacting with or triggering Web Authentication APIs.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious HTML page containing specialized JavaScript designed to interact with the Web Authentication API in a precise sequence.\nSecond, when the victim renders the page, the browser initiates asynchronous Web Authentication operations involving the vulnerable component.\nThird, through race conditions, deliberate object lifecycle manipulation, or premature garbage collection within the C++ implementation of the Web Authentication subsystem, the attacker forces a target heap object to be freed while internal references to it remain active.\nFourth, the attacker triggers heap spray or heap grooming techniques to reallocate the freed memory region with attacker-controlled payload data.\nFifth, when the application attempts to access the original object via the dangling pointer, it instead executes or processes the attacker-controlled data, resulting in control flow hijacking.\nFinally, leveraging this memory corruption within the renderer process, the attacker exploits secondary weaknesses or architectural flaws to break out of the Chromium security sandbox, achieving arbitrary execution in a higher-privileged context."
}