Description

Use after free in Chromoting in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-25T21:17:48.813Z",
  "pubdate": "2026-08-25T21:17:48.813Z",
  "executiveSummary": "A critical use-after-free vulnerability has been identified within the Chromoting component of Google Chrome. This memory corruption flaw exists due to improper management of object lifecycles within the codebase.\nThe vulnerability allows a remote, unauthenticated attacker to trigger arbitrary code execution outside the browser's security sandbox environment. By sending crafted network traffic to a vulnerable client, an attacker can manipulate the memory state of the application to execute malicious instructions.\nThe vulnerability affects Google Chrome versions prior to 152.0.7977.65. Given the potential for sandbox escape and remote code execution, this flaw represents a significant risk to user systems and data integrity.\nThe exploitation process does not require local authentication, relying instead on network-based interaction with the Chromoting service. Successfully weaponizing this flaw could lead to full system compromise depending on the user's privilege level and the specifics of the sandbox breakout.",
  "technicalDetails": "The root cause of this vulnerability is a use-after-free (UAF) condition within the Chromoting subsystem of Chromium. A UAF vulnerability occurs when an application continues to use a pointer to a memory location after the underlying object has been explicitly freed or moved. In this instance, the memory allocator reclaims the block previously occupied by a Chromoting object, which is then overwritten by subsequent operations.\nWhen an attacker delivers specially crafted network traffic to the Chromoting component, it triggers a race condition or a specific sequence of state transitions that causes the application to reference a dangling pointer. Because the memory at that location has been reallocated to another object or controlled data structure, the attacker can influence the program's execution flow. By carefully orchestrating the heap layout, an attacker can replace the freed memory with attacker-controlled data, often containing malicious function pointers or objects that manipulate the virtual method table (vtable).\nThe attack flow begins with the delivery of malicious payloads via network protocols utilized by Chromoting. Once the application processes this traffic, the dangling pointer is dereferenced during a subsequent operation. This interaction forces the program to execute instructions at a memory address redirected by the attacker. Because the vulnerability resides within the Chromoting implementation, which may interact with system-level resources or underlying OS APIs, the exploitation can bypass the standard Chromium sandbox, granting the attacker execution capabilities with the privileges of the Chromoting process.\nThe vulnerability is localized to the Chromoting architecture within Google Chrome. It is present in all versions prior to 152.0.7977.65. The lack of proper reference counting or lifecycle management during object disposal is the primary technical failure. Post-exploitation, an attacker gains the ability to execute arbitrary machine code, which may be leveraged to install persistent backdoors, exfiltrate sensitive data, or move laterally within the host network.\nThe exploitation does not require prior authentication, and the network exposure is inherent to any system running the Chromoting service. Successful payload execution results in a bypass of the browser's sandbox protections, transitioning the threat from a browser-contained vulnerability to a full system compromise."
}