Description

Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-06T22:16:59.590Z",
  "pubdate": "2026-08-06T22:16:59.590Z",
  "executiveSummary": "A use-after-free vulnerability exists within the Media component of Google Chrome on Windows prior to version 151.0.7922.109. This memory corruption flaw allows a remote attacker to potentially perform a sandbox escape and execute arbitrary code on the underlying operating system. The vulnerability is classified by Chromium security severity as High, reflecting its capability to compromise system integrity and security boundaries if successfully exploited. The attack vector requires the victim to process or interact with a specially crafted HTML page controlled by the attacker, typically by visiting a malicious website. Exploitation of this flaw undermines the browser's multi-process security architecture, potentially enabling full system access within the context of the user if the sandbox containment is successfully bypassed. No privileged access or prior authentication is required by the attacker, making web-based delivery mechanisms highly effective for initiating the attack chain.",
  "technicalDetails": "The vulnerability resides in the Media component of Google Chrome, specifically stemming from memory management errors associated with object lifetimes and heap allocation handling. A use-after-free condition occurs when the application attempts to reference a memory address after the corresponding resource has been deallocated or freed. This typically happens due to improper reference counting or flawed state synchronization within asynchronous media processing routines. In this specific scenario, a remote attacker can construct a malicious HTML page embedded with specific scripts, media elements, or layout triggers designed to manipulate the internal heap state of the rendering engine. When the victim renders the crafted HTML page, the vulnerable Media component improperly handles the lifecycle of specific media objects, leading to a dangling pointer condition. Subsequent operations attempt to access the freed memory location, which the attacker can potentially groom or manipulate via heap spraying techniques to control the contents of the reallocated memory block. By achieving deterministic heap layout control, the attacker can hijack the program control flow, leading to arbitrary code execution. Because the vulnerability manifests within the context of the browser's rendering or media handling pipeline, successful exploitation provides a pathway to execute arbitrary payloads that can interact with system APIs. Consequently, this enables the attacker to break out of the restricted Chromium sandbox environment, resulting in a sandbox escape and elevated risk to the host operating system. The affected software consists of Google Chrome on Windows prior to version 151.0.7922.109, requiring no authentication or local privileges from the remote attacker other than the ability to deliver a crafted web page to the victim browser."
}