Description

Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T22:17:21.230Z",
  "pubdate": "2026-08-11T22:17:21.230Z",
  "executiveSummary": "A use-after-free vulnerability exists in the V8 JavaScript engine utilized by Google Chrome prior to version 151.0.7922.137. This memory corruption flaw permits a remote attacker to execute arbitrary code within the confines of the browser sandbox.\nThe vulnerability poses a high-severity risk to users browsing untrusted web content. By convincing a victim to load a maliciously crafted HTML page, an attacker can leverage the use-after-free condition to manipulate heap memory structures.\nSuccessful exploitation requires user interaction, specifically navigating to a malicious webpage containing the exploit payload. The impact includes remote code execution, compromising the integrity and stability of the affected browser instance.\nSystems running Google Chrome versions older than 151.0.7922.137 are directly impacted. The primary risk involves sandbox-contained code execution, which could potentially be chained with additional vulnerabilities for broader system compromise.",
  "technicalDetails": "The vulnerability is classified as a use-after-free memory corruption flaw residing within the V8 component of Google Chrome. A use-after-free condition occurs when an application continues to use a pointer after the memory region it references has been deallocated or freed.\nThe vulnerable component is the V8 JavaScript engine memory management subsystem. Affected software versions include Google Chrome builds prior to 151.0.7922.137. The flaw manifests when specific object lifecycles are improperly managed during script execution or garbage collection cycles.\nAttack flow begins when a remote attacker hosts a crafted HTML page containing malicious JavaScript or leveraging specific Document Object Model (DOM) interactions. When a victim loads this page using an unpatched instance of Google Chrome, the browser processes the malicious sequence.\nStep-by-step exploitation involves the premature freeing of a heap object in V8 while a dangling pointer referencing that object is retained. Subsequent manipulation of the dangling pointer allows the attacker to trigger memory reuse of the freed slot. By crafting conflicting heap layouts through heap spraying or precise allocation techniques, the attacker can replace the freed object with controlled payload data.\nExecution of the crafted script leads to type confusion or arbitrary read/write primitives within the V8 heap. This state enables the attacker to hijack control flow and execute arbitrary code inside the Chromium sandbox.\nNetwork exposure is remote via standard web browsing protocols. Authentication and special local privilege requirements are nonexistent; the victim only needs to visit the attacker-controlled URL using a vulnerable browser version. Post-exploitation impact is constrained by the Chromium sandbox boundary, limiting direct host access unless bypassed via an additional exploit chain."
}