Description

Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:17:50.297Z",
  "pubdate": "2026-08-25T21:17:50.297Z",
  "executiveSummary": "A use-after-free vulnerability exists within the DevTools component of Google Chrome prior to version 152.0.7977.65. This flaw allows a remote attacker to achieve arbitrary code execution within the confines of the browser's sandbox. The vulnerability necessitates social engineering to deceive a user into installing or interacting with a maliciously crafted Chrome extension. Successful exploitation grants an attacker the ability to bypass intended security controls, leading to potentially unauthorized actions performed under the context of the extension's privileges. The Chromium project has categorized the severity of this vulnerability as Medium, reflecting the required user interaction and the sandbox restrictions that limit the scope of impact.",
  "technicalDetails": "The vulnerability is identified as a use-after-free (UAF) memory corruption defect located within the DevTools infrastructure of the Chromium rendering engine. A UAF occurs when an application continues to utilize a memory pointer after the memory at that location has been deallocated or freed. In the context of DevTools, this typically involves the improper lifecycle management of objects associated with debugging sessions or developer-focused inspection interfaces.\nThe attack vector requires the delivery of a crafted Chrome extension to the victim. This process is inherently reliant on social engineering techniques to induce the user to install the malicious package. Once installed, the extension leverages exposed or vulnerable DevTools APIs that maintain references to stale objects. By triggering a specific sequence of operations that lead to the deallocation of an object, followed by a subsequent attempt to access that same memory address, an attacker can manipulate the heap state.\nDuring the exploitation flow, the attacker performs heap grooming to ensure that the freed memory block is reallocated with attacker-controlled data. When the application subsequently invokes the dangling pointer, it inadvertently executes code or follows data structures provided by the attacker. Because this occurs within the browser sandbox, the scope of arbitrary code execution is restricted; however, it still provides the attacker with execution capabilities that should not be accessible through the extension's legitimate API surface.\nThe vulnerability affects Google Chrome versions prior to 152.0.7977.65. The exploitation does not require the attacker to have pre-existing authentication, but it does necessitate the successful execution of social engineering to facilitate the installation of the payload. The post-exploitation impact includes the ability to execute arbitrary code within the sandboxed environment, potentially leading to unauthorized data access, persistence within the extension's context, or other malicious activities permissible within the sandbox limitations."
}