Description

Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-11T22:17:21.440Z",
  "pubdate": "2026-08-11T22:17:21.440Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Extensions component of Google Chrome prior to version 151.0.7922.137. This memory corruption flaw allows a remote attacker to execute arbitrary code within a sandbox environment by tricking a user into installing a specifically crafted malicious Chrome extension.\nThe vulnerability carries a high security severity rating within the Chromium project. Successful exploitation requires user interaction to install the malicious extension, after which the attacker can achieve code execution under the constraints of the browser sandbox.\nThe risk implications include potential sandbox-contained compromise of the browser environment through malicious extension execution. The primary attack vector relies on social engineering to induce the victim into installing the crafted extension, which subsequently triggers the use-after-free condition during internal extension handling processes within Google Chrome.",
  "technicalDetails": "The vulnerability stems from a use-after-free memory management flaw located within the Extensions component of Google Chrome prior to version 151.0.7922.137. A use-after-free condition occurs when a program continues to use a pointer after the memory region it references has been deallocated or freed, typically leading to memory corruption, dangling pointers, and potential control flow hijacking.\nThe attack flow begins when an attacker crafts a malicious Chrome extension designed to interact with vulnerable internal APIs or object lifecycles within the browser's Extensions subsystem. The attacker must then convince a victim to install this crafted extension, as direct exploitation without installation or via standard web navigation is not described.\nUpon installation and execution of the malicious extension, the extension interacts with specific internal browser components in a sequence that triggers the premature freeing of a memory object while retaining a reference to it. Subsequent operations access this dangling pointer, allowing the attacker to manipulate the reallocated heap memory.\nBy carefully controlling the heap layout and exploiting the use-after-free condition, the attacker can achieve arbitrary code execution. However, this execution is contained within the confines of the browser sandbox, limiting the direct impact on the underlying operating system unless chained with a separate sandbox escape vulnerability.\nThe vulnerability affects Google Chrome versions prior to 151.0.7922.137. Authentication or specific network exposure beyond the initial installation vector is not strictly required, as the flaw is triggered locally by the installed extension processing crafted instructions. Privilege requirements are minimal from the browser perspective, requiring only standard user interaction to install the extension."
}