Description

Race condition in Enterprise in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-25T21:17:49.047Z",
  "pubdate": "2026-08-25T21:17:49.047Z",
  "executiveSummary": "A race condition vulnerability exists within the Enterprise component of Google Chrome on Windows, specifically impacting versions prior to 152.0.7977.65. This flaw allows an adjacent attacker to bypass sandbox isolation mechanisms, potentially facilitating arbitrary code execution.\nThe vulnerability is classified as a sandbox escape, a critical security boundary failure. By leveraging crafted network traffic, an attacker operating on the same network segment can manipulate synchronization primitives or shared resources to induce an race condition state.\nThe primary risk implication is the compromise of the integrity and confidentiality of the host operating system, as successful exploitation enables the transition from a constrained, sandboxed browser environment to execution within the security context of the user or system process. Despite its 'Low' severity rating in the Chromium classification, the capability to escape the sandbox poses a significant threat to enterprise environments where browser security is a core pillar of host protection.\nExploitation requires the attacker to be positioned adjacently to the target, limiting the scope to local network proximity. No user authentication is explicitly required, but the success of the attack is dependent on the browser processing specific, maliciously engineered network traffic during the vulnerable race window.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper synchronization handling within the Google Chrome Enterprise component on the Windows platform. Race conditions occur when a system’s substantive behavior is dependent on the sequence or timing of uncontrollable events, such as threads competing for access to a shared resource.\nIn this instance, the Chromium sandbox relies on strict boundary enforcement for network packet processing. An adjacent attacker, positioned on the local network, can transmit crafted network traffic designed to trigger a race condition in the browser's network stack or the interface between the renderer process and the browser process. By precisely timing the arrival of these network packets, the attacker forces the browser to evaluate state information in an inconsistent order.\nThe attack flow begins with the injection of malformed or specifically crafted network packets into the browser's ingress path. As the Enterprise component handles these packets, the race condition allows the attacker to exploit a 'time-of-check to time-of-use' (TOCTOU) flaw. Because the browser process performs operations on shared memory or global state variables without sufficient atomic protection, an attacker can influence the outcome of the browser's security policy validation.\nBy successfully winning the race, the attacker forces the browser to bypass or misinterpret sandbox restrictions, allowing for a breakout. Once the sandbox isolation is invalidated, the payload—which may be contained within the network traffic—can execute with the elevated privileges associated with the browser process on the Windows host. This facilitates arbitrary code execution, granting the attacker the ability to interact directly with system APIs that are typically restricted from within the browser's sandbox environment.\nThe vulnerability affects all Google Chrome Enterprise versions on Windows prior to 152.0.7977.65. The complexity of the exploit is high, as it requires precise network-level timing and a deep understanding of the internal thread management and synchronization patterns utilized by the Chromium networking sub-components. Post-exploitation, the impact is significant, as it effectively renders the browser's primary security boundary null, allowing an attacker to persist, extract sensitive data, or install further malware on the underlying Windows operating system."
}