Description

Out of bounds write in Crashpad in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-25T21:17:51.187Z",
  "pubdate": "2026-08-25T21:17:51.187Z",
  "executiveSummary": "This vulnerability is an out-of-bounds write flaw identified in the Crashpad component of Google Chrome on Windows.\nThe vulnerability occurs prior to version 152.0.7977.65 and is classified with a High security severity.\nThe flaw allows a remote attacker, who has already compromised the sandboxed renderer process, to perform an out-of-bounds memory write.\nSuccessful exploitation enables an attacker to achieve arbitrary code execution outside the confines of the browser sandbox, potentially leading to full system compromise.\nThe attack is triggered via a specially crafted HTML page. The primary risk implication is a sandbox escape, which subverts the layered security model of the browser.\nThe vulnerability represents a critical escalation path for attackers leveraging initial renderer-level code execution to gain higher-privileged access on the underlying Windows operating system.",
  "technicalDetails": "The vulnerability resides within Crashpad, the crash reporting system utilized by Chromium-based browsers. Crashpad is responsible for capturing process state and memory dumps when a crash occurs. The flaw specifically pertains to an out-of-bounds write condition that can be triggered when the system processes malicious input during the crash reporting or diagnostic data handling phase.\nAn out-of-bounds write occurs when a software component writes data past the intended boundary of a buffer. In this context, a remote attacker must first achieve execution within the renderer process, typically by exploiting a separate vulnerability such as a use-after-free or a type confusion bug. Once in control of the renderer process, the attacker can supply crafted data to the Crashpad component.\nThe attack flow begins with the attacker serving a malicious HTML page. Upon navigating to this page, the renderer process is compromised. The attacker then interacts with the Crashpad interface to initiate a crash or error condition. By providing input that violates expected buffer constraints, the attacker forces the Crashpad process—which often operates with higher privileges or in a different security context than the renderer—to write data into unauthorized memory locations.\nThis memory corruption allows the attacker to overwrite critical control structures, such as function pointers or return addresses, within the Crashpad process space. By controlling the data written out-of-bounds, the attacker can redirect the execution flow to malicious shellcode or execute return-oriented programming (ROP) chains to bypass security features like Control Flow Guard (CFG) or Data Execution Prevention (DEP).\nBecause Crashpad is essential for diagnostic stability, it often has access to various system-level APIs. Successfully hijacking the execution flow at this stage effectively grants the attacker the privilege level of the crash handler, which is generally sufficient to escape the renderer sandbox. This allows the adversary to transition from restricted environment access to executing arbitrary code in the context of the user or a higher-privileged system process on the host Windows machine.\nThe vulnerable component is explicitly identified as Crashpad within Chromium versions prior to 152.0.7977.65. Exploitation does not require prior authentication, provided the attacker has successfully gained initial code execution in the renderer via the malicious HTML page, and the attack is executed through standard web browsing channels."
}