Description

Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-06T22:17:00.040Z",
  "pubdate": "2026-08-06T22:17:00.040Z",
  "executiveSummary": "A use-after-free vulnerability exists within the Payments component of Google Chrome prior to version 151.0.7922.109.\nThis security flaw allows a remote attacker to potentially achieve a sandbox escape through the ingestion of a maliciously crafted HTML page.\nCategorized with a high severity level by Chromium security standards, the vulnerability poses significant risk to end-user systems by potentially permitting attackers to break out of the browser security sandbox and compromise the underlying operating system.\nThe attack vector requires user interaction, specifically navigating to or rendering a specially crafted web page controlled by the adversary.\nSuccessful exploitation compromises the integrity and isolation guarantees provided by the Chromium sandbox architecture, elevating the threat landscape for affected browser deployments.",
  "technicalDetails": "The root cause of the vulnerability is a use-after-free memory management defect within the Payments subsystem of Google Chrome prior to version 151.0.7922.109.\nA use-after-free condition occurs when an application continues to use a pointer after the memory region it references has been deallocated or freed.\nThis typically arises from improper object lifecycle management, dangling pointers, or race conditions during complex asynchronous operations within the browser engine.\nThe attack flow begins when a remote attacker induces a victim to visit a specially crafted HTML page loaded into Google Chrome.\nUpon rendering or interacting with the malicious HTML payload, the browser triggers specific code paths within the Payments component that improperly handle heap memory.\nBy manipulating heap layouts and triggering the dangling pointer dereference, the attacker can achieve arbitrary read/write primitives within the browser process memory space.\nThrough sophisticated memory corruption techniques targeting internal browser structures, the attacker leverages the use-after-free primitive to execute arbitrary code or orchestrate a sandbox escape.\nNetwork exposure is remote, as the attack requires the victim to access content controlled by the adversary over the web.\nNo prior authentication or high-privilege system access is required on the target machine, relying entirely on the browser's processing of untrusted web content.\nThe post-exploitation impact includes breaching the Chromium security sandbox boundaries, potentially allowing the execution of system-level instructions or access to local resources outside the browser containment environment."
}