Description

Use after free in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:18:28.643Z",
  "pubdate": "2026-08-18T21:18:28.643Z",
  "executiveSummary": "A use-after-free vulnerability exists in the WebGL component of Google Chrome prior to version 151.0.7922.169.\nThe vulnerability allows a remote attacker to execute arbitrary code inside the browser sandbox by enticing a user to visit a crafted HTML page.\nThe security severity of this issue is rated as High by the Chromium security team, reflecting its potential to compromise the renderer process and breach sandbox isolation boundaries.\nSuccessful exploitation requires the victim to interact with malicious web content, such as navigating to a specially crafted webpage utilizing malicious WebGL instructions.\nThe primary risk implications include potential remote code execution within the constrained context of the sandbox, enabling further exploitation chains if combined with sandbox escape vulnerabilities.",
  "technicalDetails": "The root cause of the vulnerability is a use-after-free condition within the WebGL graphics rendering pipeline of Google Chrome.\nA use-after-free vulnerability arises when memory is referenced after it has been deallocated, typically due to improper memory management, dangling pointers, or flawed object lifecycle tracking within the affected component.\nThe vulnerable component is the WebGL implementation handling graphics contexts and rendering operations inside the Chromium browser architecture.\nAttack flow begins when a remote attacker hosts a crafted HTML page containing malicious WebGL payloads designed to manipulate object allocation and deallocation sequences.\nWhen a user loads the crafted HTML page, the browser parses the malicious WebGL content, triggering an improper state where a pointer continues to reference memory that has already been freed.\nBy manipulating the heap layout via controlled memory spraying or heap grooming techniques, the attacker can replace the freed memory block with controlled data or executable primitives.\nSubsequent execution paths attempting to access the dangling pointer interact with the attacker-controlled memory, leading to memory corruption and hijacking of the application execution flow.\nThis exploitation vector enables the remote attacker to execute arbitrary code within the constraints of the browser's sandbox environment.\nThe affected product is Google Chrome, specifically all versions prior to 151.0.7922.169.\nNo authentication or elevated privileges are required by the attacker, as the attack vector is network-exposed via standard web browsing and relies entirely on user interaction with a crafted HTML page."
}