Description

Use after free in Search in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:17:49.500Z",
  "pubdate": "2026-08-25T21:17:49.500Z",
  "executiveSummary": "This vulnerability is a Use-After-Free (UAF) memory corruption flaw identified within the Search component of Google Chrome on Android. The vulnerability arises from improper management of object lifecycles within the browser's memory, allowing a remote attacker to manipulate stale memory pointers.\nThe security impact is classified as Medium by the Chromium project; however, it presents a significant risk as it allows for potential arbitrary code execution outside the browser sandbox. This indicates that the vulnerability can be leveraged to bypass critical browser security boundaries.\nThe attack vector is remote, requiring a victim to navigate to a specifically crafted HTML page. Success is facilitated by social engineering techniques to induce the user into interacting with the malicious content. Because the vulnerability exists in versions prior to 152.0.7977.65, users on legacy versions are exposed to remote compromise. Successful exploitation grants the attacker the ability to execute arbitrary code within the context of the device, posing a severe threat to data integrity and system privacy.",
  "technicalDetails": "The vulnerability is rooted in a Use-After-Free condition within the Search feature of Google Chrome for Android. A UAF vulnerability occurs when an application continues to utilize a memory address after the memory previously allocated to that address has been freed. In the context of the Chromium architecture, this typically involves a race condition or an improper object reference count where the browser’s memory allocator releases a chunk of heap memory while a dangling pointer remains active in a specific component.\nThe exploitation flow initiates when a remote attacker hosts a malicious HTML document designed to trigger a specific sequence of operations in the browser's search sub-system. When the victim loads this page, the attacker uses embedded scripts to force the browser to allocate and subsequently deallocate an object related to the Search functionality. By meticulously controlling the heap layout—often through heap grooming or spraying techniques—the attacker can replace the freed object with controlled malicious data.\nWhen the browser later attempts to reference the original pointer, it unknowingly interacts with the attacker-controlled memory instead of the expected object. This leads to arbitrary control over the program's execution flow. In this specific instance, the vulnerability is severe enough to allow the attacker to escape the Chromium sandbox, which is the primary security boundary protecting the Android OS from the browser process.\nThe vulnerability affects all Google Chrome for Android versions prior to 152.0.7977.65. Authentication is not required for an attacker to initiate the exploitation process, and the exploit relies primarily on social engineering to lure the user to the malicious URI. The impact of the post-exploitation phase allows the adversary to execute code with the permissions of the browser application, potentially leading to unauthorized data access, information disclosure, or further system-level escalation if paired with secondary Android kernel exploits."
}