Description

Use after free in Blink in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T22:17:21.647Z",
  "pubdate": "2026-08-11T22:17:21.647Z",
  "executiveSummary": "A use-after-free vulnerability exists within the Blink rendering engine of Google Chrome prior to version 151.0.7922.137, posing a significant risk to client-side security.\nThe flaw allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by inducing memory corruption through a maliciously crafted HTML page.\nAffected systems include any instance of Google Chrome running versions earlier than 151.0.7922.137, exposing users to drive-by download and browser exploitation vectors.\nThe risk implications are severe, as successful exploitation circumvents fundamental browser isolation boundaries and enables malicious payloads to execute within the context of the renderer process.\nAttacker capabilities are constrained by the browser sandbox, requiring chained vulnerabilities for full system compromise, but nevertheless permit local memory manipulation and code execution.\nExploitation requirements include user interaction, specifically convincing a target user to navigate to or render a specially crafted web page containing malicious HTML and JavaScript elements.",
  "technicalDetails": "The root cause of the vulnerability stems from a use-after-free condition in the Blink component, where memory is improperly managed during object lifecycle handling, leading to dangling pointers.\nThe vulnerable component is the Blink rendering engine, specifically within memory management routines responsible for processing document object models or layout trees.\nAffected software versions encompass all Google Chrome releases prior to 151.0.7922.137.\nAuthentication requirements are absent; the vulnerability can be triggered remotely without prior authentication or user credentials.\nPrivilege requirements are minimal, requiring only standard user interaction to visit a malicious web resource.\nNetwork exposure is inherent to web browsers, as the attack vector relies on network-delivered content via standard HTTP or HTTPS protocols.\nThe step-by-step attack flow commences when a victim accesses a crafted HTML page hosted by the attacker.\nUpon rendering the page, the browser interacts with malformed or maliciously manipulated DOM structures or layout objects, triggering improper reference counting or premature deallocation of memory in Blink.\nThe underlying object is freed, but a reference to the memory address is retained within the application context.\nSubsequent execution paths access this dangling pointer, resulting in a use-after-free condition.\nThe attacker leverages heap manipulation techniques, such as heap spraying or precise heap grooming, to allocate controlled data into the recently freed memory slot.\nBy overlapping critical object structures or function pointers with controlled payload data, the attacker redirects execution flow.\nPost-exploitation impact involves the execution of arbitrary shellcode or native instructions within the constraints of the sandboxed renderer process, potentially serving as a stepping stone for sandbox escape exploits."
}