Description

Use after free in TabStrip in Google Chrome on Mac prior to 151.0.7922.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-11T22:17:21.340Z",
  "pubdate": "2026-08-11T22:17:21.340Z",
  "executiveSummary": "A use-after-free vulnerability exists within the TabStrip component of Google Chrome on Mac prior to version 151.0.7922.137.\nThe flaw allows a remote attacker who has already successfully compromised the renderer process to potentially achieve a sandbox escape through the ingestion of a specially crafted HTML page.\nThis vulnerability carries a Chromium security severity rating of High, presenting significant risk to client-side system integrity and security boundaries if exploited.\nSuccessful exploitation requires the attacker to first compromise the rendering engine context to interact with the vulnerable browser-side TabStrip implementation.\nThe primary impact of this vulnerability is the potential circumvention of the Chromium security sandbox, exposing the underlying operating system and user environment to further exploitation.",
  "technicalDetails": "The vulnerability is rooted in a use-after-free memory management defect residing in the TabStrip component of Google Chrome on Mac.\nA use-after-free condition occurs when memory is referenced after it has been deallocated, leading to potential pointer corruption, undefined behavior, and arbitrary code execution capabilities.\nThe affected software versions include Google Chrome on Mac prior to version 151.0.7922.137.\nExploitation requires an attacker to first compromise the renderer process, typically achieved by leveraging a separate vulnerability or execution vector within the web content handling engine.\nOnce the renderer process is compromised, the attacker delivers a crafted HTML page designed to interact with the browser process via inter-process communication (IPC) or shared state mechanisms tied to the TabStrip.\nBy manipulating object lifetimes and triggering premature deallocation followed by subsequent re-referencing within the TabStrip component, the attacker forces a memory corruption condition.\nThis memory corruption within the browser-side context enables the execution of arbitrary code outside the restricted constraints of the renderer sandbox.\nConsequently, this sequence of events facilitates a sandbox escape, granting the attacker elevated privileges within the context of the browser process on the host operating system."
}