Description

Use after free in Compositing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:17:55.313Z",
  "pubdate": "2026-08-25T21:17:55.313Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability exists within the Compositing component of Google Chrome prior to version 152.0.7977.65.\nThe flaw stems from improper memory management within the browser's rendering engine, specifically affecting the compositing lifecycle.\nA remote attacker can leverage this vulnerability by enticing a user to navigate to a specifically crafted HTML page, triggering memory corruption.\nSuccessful exploitation allows for the execution of arbitrary code within the confines of the browser's security sandbox.\nWhile the sandbox provides a layer of isolation, the ability to achieve arbitrary code execution via remote content represents a significant security risk, categorized by Chromium as Medium severity.\nThe vulnerability does not require authentication or elevated user privileges, relying solely on the user interacting with malicious web content to initiate the attack flow.",
  "technicalDetails": "The vulnerability is rooted in a Use-After-Free (UAF) condition within the Compositing module of the Chromium rendering engine. In the context of browser internals, Compositing is responsible for managing layer trees and orchestrating the painting of visual elements to the screen. The flaw occurs when an object associated with the compositor layer tree is freed, but a reference to the freed memory remains active in a dangling state.\nThe attack flow begins when a remote attacker delivers a crafted HTML page containing complex Document Object Model (DOM) structures or specific CSS properties designed to force the compositor to perform lifecycle state changes. As the renderer processes these elements, a race condition or a lifecycle mismanagement scenario occurs where the compositor releases an object prematurely while a subsequent task or event loop iteration still holds a stale pointer to that object.\nUpon accessing the stale pointer, the application performs a 'use' operation on memory that has been deallocated. An attacker can influence the heap layout through heap spraying or grooming techniques—often utilizing Javascript objects or large arrays—to replace the freed object with attacker-controlled data. When the compositor subsequently dereferences the dangling pointer, it inadvertently executes logic using the malicious payload now residing at that memory address.\nGiven that this operation occurs within the renderer process, successful exploitation results in arbitrary code execution within the sandbox environment. This effectively grants the attacker the ability to execute malicious instructions under the context of the renderer process. The Chromium sandbox serves as the primary barrier preventing the attacker from escaping to the underlying operating system, yet the impact remains severe as it allows for the manipulation of browser state, exfiltration of sensitive information processed within the renderer, or potential chaining with secondary sandbox escape vulnerabilities.\nThe vulnerability affects Chromium-based browsers prior to version 152.0.7977.65. The lack of proper reference counting or lifecycle synchronization within the compositor layer management logic is the primary technical failure leading to this memory safety issue."
}