Description

Use after free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:17:47.290Z",
  "pubdate": "2026-08-25T21:17:47.290Z",
  "executiveSummary": "A critical use-after-free vulnerability exists within the V8 JavaScript engine of Google Chrome. This memory corruption flaw allows a remote attacker to achieve arbitrary code execution within the browser's sandbox environment.\nThe vulnerability originates from improper memory management in V8, where a pointer is accessed after the memory it references has been deallocated. Successful exploitation enables a remote attacker to trigger a secondary memory corruption event by leveraging a specially crafted HTML document.\nThe scope of impact is significant, as it grants an attacker the ability to execute malicious payloads under the context of the renderer process, potentially leading to unauthorized data access or sandbox escape attempts.\nThe vulnerability affects all Google Chrome versions prior to 152.0.7977.65. While the attack is restricted to the sandbox, it presents a high security risk, particularly for users interacting with untrusted web content. Exploitation does not require user authentication, making it a viable vector for drive-by download attacks via malicious web pages.",
  "technicalDetails": "The vulnerability is a use-after-free (UAF) condition located within the V8 engine, which is the JavaScript and WebAssembly engine used by Chromium-based browsers. A UAF vulnerability occurs when the application continues to use a pointer after the memory address it points to has been freed or reallocated. In the context of V8, this typically involves the garbage collector (GC) incorrectly identifying an object as unreachable or failing to update references during object migration or disposal.\nThe attack flow begins when a remote attacker hosts a crafted HTML page containing malicious JavaScript designed to manipulate the heap state. By triggering specific operations that force the V8 garbage collector to reclaim an object prematurely while a dangling reference remains in the execution stack or object graph, the attacker creates a memory safety violation. Once the dangling reference is accessed, the engine inadvertently performs operations on memory that may have been repurposed for other objects, providing a primitive for arbitrary memory read/write or control flow hijacking.\nExploitation involves achieving a stable heap grooming state where the freed memory is reallocated with controlled data. The attacker exploits this to overwrite internal V8 structures—such as function pointers, hidden classes, or object maps—to achieve type confusion or redirect execution flow. By corrupting the vtable or object descriptors, the attacker can hijack the program counter, leading to arbitrary code execution within the renderer process.\nBecause the execution occurs within the renderer process, the impact is strictly confined to the sandbox environment. However, this level of access allows the attacker to execute arbitrary shellcode, bypass same-origin policy (SOP) protections, and potentially leverage secondary vulnerabilities to attempt a sandbox escape or privilege escalation to the host operating system. The vulnerability is triggered automatically upon rendering the malicious page, requiring no user interaction beyond navigating to the site. The affected component is the V8 engine, and specifically the subsystems responsible for object lifetime management and garbage collection. All versions prior to 152.0.7977.65 are susceptible, with no requirement for prior authentication or elevated privileges."
}