Description

Race condition in ReadAloud in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-25T21:17:49.160Z",
  "pubdate": "2026-08-25T21:17:49.160Z",
  "executiveSummary": "A critical race condition vulnerability exists within the ReadAloud feature of Google Chrome, identified in versions prior to 152.0.7977.65. This security flaw allows a remote attacker to compromise the integrity of the browser environment through a specifically crafted HTML page.\nThe vulnerability is categorized as a race condition, which occurs when the timing or sequence of events affects the execution of code, leading to unintended behavior. By leveraging social engineering techniques to entice a user into navigating to a malicious page, an attacker can trigger the flaw to achieve arbitrary code execution within the browser's sandbox.\nThe impact of this vulnerability is severe, as it facilitates unauthorized code execution, potentially leading to data exfiltration, cross-site scripting, or further exploitation of the host system if secondary sandbox escape vulnerabilities are identified. The exploit requires user interaction via social engineering, but the potential for silent background execution remains high once the page is rendered. Given the broad deployment of Google Chrome, this vulnerability presents a significant risk to end-user security, necessitating prompt patching to the specified stable version or later to neutralize the threat vector.",
  "technicalDetails": "The vulnerability originates from a race condition located within the ReadAloud component of the Chromium browser architecture. A race condition occurs when multiple threads or processes access shared resources or memory locations without proper synchronization, resulting in a non-deterministic state that an attacker can influence to gain control over the instruction pointer or modify memory contents.\nIn this specific instance, the ReadAloud feature, which facilitates the text-to-speech rendering of web content, fails to implement adequate concurrency controls during the processing of dynamic HTML elements. The root cause is likely an improper locking mechanism or an asynchronous event-handling oversight during the parsing or state-transition phases of the feature's pipeline.\nThe attack flow begins when a user is convinced to navigate to a malicious HTML page controlled by the attacker. Upon rendering, the malicious page initiates a series of operations designed to stress the ReadAloud engine. By inducing specific timing delays or rapid state updates, the attacker forces the browser to access resources while they are in an inconsistent or partially updated state. This exploit pattern exploits the temporal window between the initiation of an asynchronous request and the subsequent validation or state cleanup.\nOnce the race condition is successfully triggered, the attacker achieves arbitrary code execution within the constraints of the browser's sandbox. While the sandbox limits the ability of the injected code to interact directly with the underlying operating system or file system, successful code execution inside the renderer process provides the attacker with a stable environment to execute malicious scripts, bypass same-origin policies (SOP), or facilitate further exploitation of the browser's internal APIs.\nThe vulnerability affects Google Chrome versions prior to 152.0.7977.65. Exploitation does not require authentication from the user beyond the initial page navigation prompted by social engineering. Because the browser process effectively performs the malicious operation on behalf of the user, the attacker benefits from the victim's existing session context. Post-exploitation, the attacker may attempt to chain this vulnerability with additional exploits to achieve privilege escalation or persistent access within the user's desktop environment by escaping the Chromium sandbox."
}