Description

Use after free in Chromoting in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-20T21:17:09.800Z",
  "pubdate": "2026-08-20T21:17:09.800Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in the Chromoting component of Google Chrome prior to version 151.0.7922.173. The flaw allows an unauthenticated remote attacker to execute arbitrary code outside the established browser sandbox context.\nExploitation of this vulnerability requires the transmission of crafted network traffic to a targeted instance. Successful execution grants the adversary the ability to compromise the underlying operating system running the browser process, bypassing sandbox isolation mechanisms entirely.\nGiven the severity and remote attack vector, this vulnerability presents a significant risk to confidentiality, integrity, and availability. Systems processing untrusted network streams via affected versions of Google Chrome are at immediate risk of remote code execution without requiring prior user interaction beyond network reachability.",
  "technicalDetails": "The vulnerability is rooted in a use-after-free condition within the Chromoting subsystem of Google Chrome. A use-after-free flaw occurs when memory is improperly managed, allowing an application to continue referencing a memory address after it has been deallocated. If the freed memory is reallocated and manipulated by an attacker, referencing the dangling pointer can lead to unexpected control flow redirection or arbitrary read/write primitives.\nThe vulnerable component is Chromoting, which handles remote desktop and streaming functionalities within Google Chrome. Network exposure is present because the component processes incoming network traffic.\nThe attack flow proceeds as follows: First, the remote attacker crafts malicious network traffic designed to interact with the Chromoting component. Second, this crafted traffic is transmitted over the network to the target running an affected version of Google Chrome prior to 151.0.7922.173. Third, improper state management or object lifecycle handling during the processing of the network packets triggers the use-after-free condition within the heap memory.\nBy carefully controlling the heap layout and timing, the attacker forces the reallocation of the freed memory block with malicious payload data. Subsequent access to the dangling pointer results in the execution of attacker-controlled instructions.\nAuthentication and local privilege requirements are nonexistent, as the attack is initiated remotely via crafted network traffic. The payload behavior and post-exploitation impact include executing arbitrary code outside the browser sandbox, leading to complete host system compromise under the security context of the user running the browser process."
}