Description

Use after free in DOM in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-20T21:17:10.280Z",
  "pubdate": "2026-08-20T21:17:10.280Z",
  "executiveSummary": "A use-after-free vulnerability resides within the Document Object Model (DOM) implementation of Google Chrome prior to version 151.0.7922.173.\nThe vulnerability allows a remote attacker to achieve arbitrary code execution inside the sandbox layer via the ingestion of a specially crafted HTML page.\nClassified with a Chromium security severity rating of High, this memory corruption flaw presents significant risk to confidentiality, integrity, and availability.\nExploitation requires user interaction, specifically the target navigating to or rendering malicious HTML content controlled by the attacker.\nSuccessful exploitation compromises the renderer process sandbox, potentially facilitating further malicious operations if chained with additional vulnerabilities.",
  "technicalDetails": "The root cause of the vulnerability is a use-after-free (UAF) condition within the Document Object Model (DOM) engine of Google Chrome.\nA use-after-free condition occurs when memory is reallocated after it has been deallocated, leading to dangling pointers.\nWhen a crafted HTML page is rendered, specific sequences of DOM manipulations trigger premature memory deallocation while retaining references to the freed heap memory within the vulnerable component.\nSubsequent operations attempting to access the dangling pointer interact with controlled heap data, allowing an attacker to manipulate execution flow.\nThe affected component is the DOM subsystem within Google Chrome versions prior to 151.0.7922.173.\nAttack vector is network-based, requiring the victim to visit a malicious webpage or view compromised HTML content.\nAuthentication requirements are none, and exploitation operates under low privilege constraints limited by the renderer sandbox.\nThe payload behavior involves heap manipulation and memory corruption, ultimately resulting in the execution of arbitrary code within the confines of the browser sandbox.\nPost-exploitation impact includes sandbox escape potential or local process compromise, depending on the availability of secondary kernel or browser process vulnerabilities."
}